i suggest we first come up with a method that prevents loss to all buyers. then, if we can do some cosmic level justice, that'd be great, and that's what tau is about. still preventing loss is more important than preventing profit.
at any case if it'll be decided to pay the bitcoins back to the buyers of the 500K, i'll pay that.
problem is we don't know who are they all, while we cannot discriminate between them.
Bittrex could give you a list of addresses that the coins are withdrawn to, and the average price those people paid.
Those users could send their Agoras to a burn address that you control. When you receive them, confirm they do actually come from said address, and pay them their BTC in return.
Maybe a little work for Bittrex and you - in fact, I don't know if this is even possible. Just an idea.