It may not have been identified specifically as an Android exploit -- there are people (I used to be one of them, though I wouldn't have used the result to exploit wallets) who constantly run crypto attacks on transactions in the blockchain to identify weak wallet keys. The person who stole the BTC probably automated the attack, left it running against the blockchain, and never even knew what the real vulnerability was.

They didn't use an Android exploit specifically, they simply scanned the blockchain for vulnerable private keys. They probably didn't even know that Android was the culprit - it could be hardware wallet, a buggy homebrew client or whatever.

Depends on the attackers attitude to risk: $5,700 worth of BTC might be a lot harder to track than the sale of an exploit. He doesn't have to trust any other human beings (i.e. the person he is selling to at least) not to dob him in at a moment's notice. A safe 5K might be very much preferable to him than a less safe 20+K.

(caveat: unless otherwise stated numbers in this post, and many of my others, are plucked from thin air)

I'm more shocked that some people actually trust their phones enough to install bitcoin clients on them.

It's possible that the exploit was used previously and the incident went unreported.

Yes, $5,700 seems a bargain to uncover a flaw like this. Shows an interesting potential use of bitcoin, can act as a warning system to identify bugs or insecure systems, like a honeypot. If the bitcoins are taken you know there is a weakness somewhere.

We don't really know that. The other obvious implication would be that we now might need new/expanded openssl/ssh key blacklists, for keys generated on Android devices.

Alternatively, someone decided it was worth $5700 to learn whether or not this bug was being exploited in the wild.