The "Whitehat? Bullshit, that's stealing" natural response isn't really justified.
If you see this bug and you don't want every user to lose their money, you are somewhat ethically bound to confiscat...
Schrödinger's white hat. Until funds are returned in full we don't know and can't know in that situation. It is fair for people to be spooked.
1