Ah that's interesting. So it's like someone stealing from them, and them saying, ok bring part of it back and we'll retro-actively tell the police/customers tha

Ah that's interesting. So it's like someone stealing from them, and them saying, ok bring part of it back and we'll retro-actively tell the police/customers that we gave your the money as payment for "testing our security". I guess that could work if no customers are affected. If customers want to get their money and it's all there for everyone, it's all good. But if it isn't, it would be awkward to tell them "we don't have your money, we bought this expensive security audit for $10M and now you only get 20% of your deposit back". Interestingly enough, they are sort of taking the side of the hacker then against the customer. Customers can go to the police and they'd laugh at them "you put your money in Abracadabra, and now you complain that, poof! your money is gone, as if by magic? Did we get that right?"