The Web3 security firm urges the rogue developer to return 80% of the stolen funds and offers 20% as a white hat bounty.