IMO, if the project is truly decentralized as they claim, then the recipients of the tokens should be entitled to keep the funds. That said, I hope the SEC will investigate this to rule out a scheme in case the bug was an intentional way to launder tokens to insiders.