What's wrong with this picture
is that this little prat will be offered a lucrative job, sock away a fortune in consultancy fees, salary, etc., and be lionised as an "expert", while the people he defrauded and robbed struggle in poverty and financial ruin probably for the rest of their lives. This is wrong on so many levels I don't know where to start.
What is needed here is a UN convention, requiring all member nations to implement as law, stating that any convicted cybercriminal recruited in a security or consultancy role, must have all money they earn taken off them and put into a reimbursement fund for victims of cybercrime. Enough money is left to them so they can afford rent, bills, food and the basic necessities of life - but no more. Further, that the cybercrook is to be kept under police surveillance and all their online activities monitored, so if they are caught engaging in fraud again, they are shown to a cell (I'd personally prefer the gallows), this time for keeps. So he then has a choice: he can live out in society on minimum wage and work out his debt, or he can rot away in prison or at the end of a rope.
As long as asshats like this hacker know they have the opportunity to step into a lucrative job as a reward for their crimes, the incitement to commit such crimes will continue to grow apace. These bastards shouldn't be getting rewarded for their "skill"; they should punished, for life, as an example to others who think they can rip people off and get rewarded for it.