The hacker may get to keep $47 million as a bug bounty, following a $117 million exploit.