IMO ehe Correct way to handle such an affair is:
Player Side:
Write email to DEVS explaining a possible exploit.
Make sure they aknowledge it.
Wait for a reasonable period (from 1 to 4 weeks).
If the devs don't respond, execute the exploit but record the numbers carefully.
Do not take personal advantage of any earnings. Stash it all away in a specific account.
After you have enough data to present the devs, stop exploiting.
Send new email with all pertinent data (exploit mechanics, people involved, time spent, acquired sum/items, etc).
Calculate your average earnings per hour and multiply by the number of hours spent, themselves multiplied by a reasonable bonus factor (say 150-200%).
Make a credit transfer to a DEV/GM char with the acquired sum MINUS the previous number.
I'm sure that any DEV/GM will react if they receive 1 Billion NIC...
DEV/PUB SIDE:
Upon detecting an exploit, approach the perpetrators and initiate dialogue.
Never name people on media.
Correct bugs/failed mechanics.
If we're talking about a pure exploit without any type of warning from the players, remove all currency from involved accounts and temporarily ban them. Second offense will mean permanent ban.
If there's a little doubt and the exploit can be attributed to a failed game mechanic... Remove all currency/items from the accounts, determine average earning/hour multiply by online hours (a statistic most publishers keep for each individual player) and restitute that amount.
After everything is sorted in this manner, deal with any possible mistakes made while enforcing corrections for a reasonable period of time (1 week).
My 2 cents.
EDIT: I actually went through such a process and things were handled so well by both sides that a new bit of lore was introduced to the game and we kept a fair amount of game currency as bonus. If you're curious: the game was JumpGate (EU server) and the new lore was the "Octavian Veteran's Day" and the mechanics involved conquering 95% of space with 12 pilots versus well over 300 adversaries (something NEARLY impossible to do) and the proceedings were 1Billion credits roughly 5 days into release.