I am not 100% certain that the hacker did anything illegal. As I understand it he exploited a loophole in the contract, that has been going on since contracts have existed and is not illegal in itself.
For me, this is the most interesting question. I suspect this was illegal, though. CFAA is pretty broad for exactly this reason -- the effect and intent, not the vector -- is what matters.
Why would the CFAA[1] apply? I don't think US law is the governing law for everything that happens on the Internet (though they'd probably love that...).
You mean jurisdictionally? E.g. if the hacker was located in the US, or in one of the many, many countries with an extradition agreement since some of those distributed computations almost certainly occurred in the us. Or in one of the many, many countries whose hacking laws are explicitly modeled on cfaa...
It's a pretty grey area. I'm not sure they did either, but my guess is that they want to find out for sure by approaching the court system. Would definitely be an interesting conversation with their lawyer.