1) Unavailability of the ICO site except for the group that can send through a lot of BTC to fill up the 50% bonus
2) DDoS the ICO site so that while attention is diverted they can inject the real payload to compromise the server and later get hold of the deposited BTC
3) DDoS BCT at the same time to disrupt communications and co-ordination around issues people have with the ICO to hide the size of the issue and to cause disarray
How would they get a hold of the deposited BTC? The Devs would have the keys.
If the attackers did indeed inject a payload into the server of the site, they could easily take control of the Pkeys of the wallet if it was hosted on the same server. Hopefully, the site team practiced good op sec and have taken precautions against this, but it is always a possibility. If the attackers managed to inject a small shell into the server, anything on that server would be compromised.