I feel this has been done for the sole purpose of making some money from gullible people (not that making money by finding security holes is bad in itself, as long as it's also combined with some social responsibility).

Making unsubstantiated statements like "6,937,081 DROPBOX ACCOUNTS HACKED" and requests like "MORE BITCOIN = MORE ACCOUNTS PUBLISHED ON PASTEBIN" makes this whole thing seem like a scam.