How will 4556 ETH be left?

The attacker created an address, the beginning and end characters of which coincided with the Galaxy Digital address, and disguised it with microtransactions. The victim copied the address from the transaction history and sent the funds.

Double-check the address and do not copy it from the transaction history.