Give him the bug bounty minus the amount he stole.  (or the bill for amount stolen as the case may be)