Neither, fully. They're gray hats who found leverage and used it.

A true white hat returns 100%, no negotiation. These guys kept $47M and made the fix a condition. That's not disclosure, that's a payout with a good story attached.

Doesn't mean they're villains either, they didn't drain it all and vanish. But calling it heroism lets them off easy. Call it what it is: opportunistic, not selfless.