Hmm, well, although I have no idea exactly which laws would apply, they should at least pay back the money. They evidently obtained it dishonestly, which must be a crime somehow. Otherwise, I could start finding and exploiting bugs in other things and become a multi-millionaire overnight without fear of any consequences!