The must have some sort of legal standing to do this, they wouldn't have done it without checking with the lawyers first.
Making all your customers take a 35% haircut even if they weren't affected by the hack seem wrong to me but they seem to think they can get away with that too.
Don't assume they have legal standing. Having a lawyer sign off on something doesn't mean you aren't breaking laws. You don't know the extent of their counsel's exposure to liability, and they may have recommended against this scheme.
If you read the terms of the BFX tokens, it is very hard to argue that they aren't securities. They are clearly some kind of bond, and possible a convertible bond (depending on the outcome of this equity talk). As such, issuing them to US customers was illegal, because they are unregistered securities. It's a criminal felony. It is likely illegal elsewhere as well, but you know, the US government is the world police, and if anyone is going to bring down Bitfinex, it's them.
Not sure if they will get away with the haircut, either. That was illegal asset conversion under any common law country (like Hong Kong, for example). A creditor needs to wait 21 days after issuing a statutory demand to Bitfinex before he can attempt to force them into bankruptcy. It is likely that no one served them the week of the hack... so it is possible we see attempts to force them into bankruptcy/lawsuits in the next couple weeks.