You're missing the fact there was a $5 million bounty to disapprove the claims. Some cyber security experts were probably hoping for an easy pay day. They probably were foolish to think he'd actually pay though. Con artists never pay when they make these big "prove me wrong" bets.