It is wrong to criminalize him. He found a bug and got a reward. Bring him in to fix the bug and to make it better. If you start scaring away people hunting for bugs and exploits for fun you will end up being exploited by a much nastier adversary

Edit: I did more research and it seems like there was some questionable actions such as creating a bunch of fake shell companies and crypto exchanges. This wasn’t a “bug” as the title is clickbait.