May I ask whether my understanding of this issue is correct?

The white hat exploited the XCP bug and get 35K XCP from the exchange and then deposit it back and sell all them to the wall and withdrew part of the BTC he got. Now the bug was fixed and the 35K XCP was rolled back.

If my understanding is correct, then every XCP bought during the dump belongs to the 35K invalid XCP from the white hat. Therefore, after client updates, those XCP will disappear. Then how come people are still asking whether the dump stands or not? The XCP has been rolled back, so the BTC balance has to be rolled back too.

EDIT After a second thought, I realized that the dump just happens in the exchange's trade book and nothing happened on the block chain. Therefore, whether they are legit or not all depends on the exchange.