Which rule is that? Thinking quickly I can't recall any rule that says that if a user is hacked and scammed that we won't help them out.

While we're still investigating to determine the details of what happened and who should take responsibility for this, if it turns out we are the ones at fault somehow then I'd imagine that there's a decent chance that we'll reinstate the losses. But to make sure I'm clear: we haven't started discussing any part of that aspect yet. When that time comes we will use the results of our investigation as well as consulting the decisions made in past cases like this (but off the top of my head I can't remember having to deal with anything like this or what direction we went in).