In my opinion..I think they should compensate him.They said he violated their terms...Their terms on the whitehat page is not even localised for other Languages. Too Bad.
Next time a hacker will just sell the exploit to somebody else, cash upfront, and wont bother reporting.
There was no bait and switch - it's very explicitly stated that he should not be exploiting the vulnerability, and that it needs to be clearly explained.
I respect that he found a vulnerability, but he still needs to adhere to a website's terms and conditions. If the security team he reports a bug to doesn't "get it" the first time he should try again, not publicize it on Hacker News and attract negative publicity by putting it on Mark Zuckerberg's wall.
"Next time a hacker will just sell the exploit to somebody else, cash upfront, and wont bother reporting."
With:
"Next time a hacker will make sure they follow the Terms of Service when reporting"
For a much more likely scenario.