It seems somewhat unlikely that someone who discovers a zero day like this, prefers having to safeguard $318 million over just sending an email to Blockstream's security team. So my guess is that is not a whitehat, but someone who wants to keep a percentage, in exchange for not being hunted down by the FBI. Either way, that probably means most funds will be recovered. We'll see.