Not illegal
Expensive bug bounty
illegal *
And if there's a bug in the code that allows hackers/thieves the ability to go against the consensus rules of the chain, that would be considered illegal creation of coins as they did not follow the rules laid out in the code.
Yeah what would top off the show is if the exploited "coins" got sent to a burn address.
It's better that this was seen sooner than later or slowly over a long period without such noise may have done more damage or could have already been doing damage for awhile.