The way I read the article, the “worth millions” is the sum of the ransom demand.

The funny part is that the exploit is in the “smart” contract, ya know the thing that the blockchain keeps secure by forbidding any updates or patches.