Since the undo button still works, ethically correct is to restore the previous state of the presale.
None is the rightful owner to benefit from the fraud. Seller or buyer.
If the case is not solved ethically correct, the thief has not only manage to stole coins but also our confidence.