Whitehat researchers are justified in transferring user assets without consent to protect them from exploits