The "Whitehat? Bullshit, that's stealing" natural response isn't really justified. If you see this bug and you don't want every user to lose their money, you are somewhat ethically bound to confiscat...