The "Whitehat? Bullshit, that's stealing" natural response isn't really justified.
If you see this bug and you don't want every user to lose their money, you are somewhat ethically bound to confiscat...
no. you need to know how to give it back and how to keep yourself safe before it should even be considered
1