Given the way this exploit was developed, I honestly think he got something on the order of the ceiling that someone who is not already known/connected on the b

Given the way this exploit was developed, I honestly think he got something on the order of the ceiling that someone who is not already known/connected on the black market could hope for. The act of advertising it in any way that could convey its potential value would likely burn it. Any pitch on the black market would tip your hand to people who had access to service logs for the past several weeks. The only way you could sell it is if you already had connections directly to people who were known to need an exploit for this service and had a channel to approach them privately, IMO. For someone in the author's situation, I think he got a very good deal and almost certainly made some great contacts that he will be happy to have in the future. (That's a long way of saying that when I run that particular thought experiment, in the context of a vulnerability where discovery provides a certain amount of disclosure should anyone go back and check logs, I have a hard time seeing a more lucrative black market. I think the math would be different in less centralized cases.)