So Cryptcracker appears to know the identity of the person who stole the coins and is asking for a % back once recovered. He does not have some magical way to brute force the private keys.

Now it appears that he is not divulging the identity but acting as an intermediary most likely threatening the thief with exposure if they don't comply. I imagine the delay is attempting to communicate with the person holding the coin.

Cryptcracker is putting a lot of trust in Paul that once the funds are recovered he will get paid. He is attempting to use public pressure and exposure of a "contract" as leverage. This exposes a naiveness on his part as it would have been better to have BTC initially transferred to an address under his control and sent the remainder back to Paul.

It is conceivable that Cryptcracker could be wrong as to the identity of the thief.