Eth "white hat group" last time sent stuff they rescued to 4+ exchanges to sell and only decided to return it after polo froze their funds. Maybe this time they behaved better. Since this was easily automated, it's unlikely they saved the funds from the attacker as he could've swept all the addresses. Seems he targeted only a few projects on purpose to minimize the chance of another bailout like if someone in EF lost money. It's still good though because others could've duplicated the bug.