Not only that, but also undid that a few minutes later. Makes no sense at all.
According to this old forum post where someone got ADA from that address, it is Binance: https://forum.cardano.org/t/my-coin-isn-t-reflecting-on-trust-wallet-but-seen-on-cardano-network/123725/19
The address where the 4800 ADA were transferred to already looks like a typical CEX deposit address: addr1q8d60n4nmf4rnyp77gcth3rh44v6kn5jjhg3fs3dwf4rj597faqjhyr7nkajrrlgy9mma4pujgdjre4257ls9n5t95gqgk922w It only has one transaction in and one out. CEXes tend to give such single-use addresses to their customers so that they can distinguish the deposits.
The outgoing transaction d9d5a03918fa01ec241f64bd5aabde0794863ae7ee155e01d4cb5c7b228ff21f of that deposit address takes a lot of these deposits and puts a small part on another address under the stame stake address (which only makes limited sense since that stake address is not registered or delegated, it just somehow groups all these deposit addresses together) and a large part of these deposits on addr1v8243y06t2lt44fj8qqs7uc5k702zgafhu5navg9f92s5ugz7wl36 which just seems to relay everything coming in further to addr1v804tgee0m3ww7z93zh64wr9flqh9psdhnxg6cykfudgulg6f633p which you already found.
Not sure for which accounting reasons they go via this relay address, but I would guess that everything from what I guessed to be a deposit address is all already inside Binance. Those addresses all have much too much activity for a usual user (even if it is an attacker/scammer).
So, you could try to contact Binance, maybe with the help of a lawyer or law enforcement, but I’m honestly not sure how promising that is. We always tell people that this is an option, but I have rarely if ever heard success stories.
Even if they were willing to cooperate, the ADA are probably long sold and gone, and the chance is very high that the used account was either stolen or created with a fake identity.
Apologies that I don’t see a way to give more hope!