Didn't they refuse to pay out a big exploit already? Was it a different company?

Edit: I misunderstood. They bought an existing one, not put up a bounty for one.