Greyhat seems appropriate here, a blackhat wouldn't have returned anything or made contact.

Still violated security.md though

Stop calling it a whitehat. You're not a whitehat if you extort. Whitehats return the funds and get nothing.

optimism

Actually as I can interpret, the hacker is asking that he should be paid 10% of the funds out of thier own money (not from the users funds), he also means if they fulfill this, the users will not lose 15% ...this also means hell refund the remaining.

Probably this proposition is because the whitehat hacker wants clean funds.

bitcoin

Liquid hacker: "You shall pay for your dereliction of duty"

Scoresby

Actually as I can interpret, the hacker is asking that he should be paid 10% of the funds out of thier own money (not from the users funds), he also means if they fulfill this, the users will not lose 15% ...this also means hell refund the remaining. 

Probably this proposition is because the whitehat hacker wants clean funds.