US recovered majority of ransom paid in Colonial Pipeline hack