I have the feeling that the attacker could sue them for this. He just got the coins by using the code and if they make a hard fork it would be like stealing the funds.