The CEO stated that the timelock will only expire if the vulnerabilities are found and fixed
[/quote]
Where did you read such statement? Honestly, all I've read is that they stated their services will be reopened "once the vulnerabilities are confirmed and fixed". That makes sense.
in other words, users can only get their funds back if the hackers refund some of the money, which I doubt will happen.
In which jurisdiction is this even legal? Shouldn't they file for bankruptcy if they're insolvent, isn't that the legal way to handle this?
I don't know where Igebotz got that from, but I don't think that's true. According to media reports, during a live briefing on September 25th, Mixin's founder, Xiaodong Feng, stated that they would compensate users "up to 50%" for the stolen assets, with the remainder being distributed to users as "tokenized liability claims" that Mixin would eventually repurchase "with its future profits".