I really think it is a bad idea to talk with the Police at this point of the story. First, because that would make this last forever, second because that would lead to the seizure of all the IT equipment so the private keys of the cold storage might get compromised.

So our best option is to let Simon work, and help him if possible.

What i think Simon should do is to take the time to comunicate with us and explain:

What happened.
What happens now
Main problems he's facing to fix things up
How can we help
How long is it going to take to withdraw funds and how can we speed this up.

Now, being said that the use of the force might not be the best option right now (calling the cops)...

I think we could help Simon if we tell him

Our username
The balance we remember.
The active orders we had
And if required, our password so he can log in as the user and check our account.

Then, after withdrawing funds, he could close our account, or mark it as processed.

Afterwards we will need to lead with 2 other problems:

First, the transactions that were sent to the engine and the engine didn't detect.
And second, the transactions to were sent to users with excesive funds.

I would start with the second issue, and, because he has all the transactions logs and identified all users (And because he only sent what was on the hot wallet) he could kindly send these users an email asking for the funds. And exposing them if they don't collaborate.

And of course, if you know that you have funds that doesn't belong to you, you can post here your intention to refund them.

Simon, think that you can work with us. And we can fix this working all together.

Hope you like the idea.

P.S. There are at least 18079+ BTC in control of Simon Hausdorf. And all mistakes were in favour of the customers (not his own), so be helpful and have faith.