If they indeed decide not to give ETH back to those from the white list who want it back, they should not give free CDT to those who sent ETH to the hacker's address.
You can not bail out one group and not the other.
Either:
1. Let people currently hold CDT return them for their ETH and give CDT to the scammed ones later.
2. Do not give CDT to the scammed ones. Do not let the white listed get their ETH back.