Agree the incentives are a mess. SEC needs to change the incentives.
For example, the process for filing complaints could include a $1M fee refundable at 2X if you're right and a tax-paying citizen and/or entity.
These types of hackers exist outside of a society ruled by law, and it's unacceptable to let them leverage the tools of a civilized society if they don't live within its rules and pay taxes.
If someone has a better idea for how to fix the incentives, I'd be sincerely interested to hear it.