Those 35K coins, were the XCP deposits in Poloniex central account. The white hat hacker, withdrew these coins from the central address and deposited it back to Poloniex and sold then on the exchange for a low price.
The order depth in Poloniex was around 100 BTC. So, the hacker took these BTC, but left some of them in the exchange.
And what happens from here? The white hat will return both XCP and BTC back to Poloniex?
The white hat return the XCP to Poloniex. The BTC is still under discussion. It depends on the benevolence of the hacker.
Also, the protocol has been patched,
re-indexing the database and resetting the XCP from the transactions. The same cannot be done for BTC.
In order for this to be successful the mayority of clients has to update the patch correct?