This all smells very bad. So the hacker exploited a vulnerability, then KiloEx gave the hacker a 10% bounty. And then the hacker returned the money and kept 10% of the $7.5M, so that's $750,000. Then KiloEx gave up on legal action.

^(!tip 1)