Regarding "when can people withdraw?" Well, right now.
Please explain exactly how people can withdraw "right now".
CR1.0 accounts are held in a database statically so we know who exactly is owed what.
Great. The unaffected coins can be returned to their OWNERS then. An option which should have been available to your customers the instant you decided to close down.
We'll have to manually go through all 180 coins and either refund every user the coins that weren't stolen
Or you could make use of the database you claim lets you know exactly who is owed what.
Quit stalling. Either release the unaffected coins or state that you have no intention of doing so.