I agree that what they are doing is illegal. I'm not sure why they are approaching it this way; their first plan (to consider losses as individualized) was legally sound and would easily prevent insolvency. What they are doing is indeed theft, and I imagine people will be pursuing them legally.
The problem is, we aren't gonna get much back that way. If they actually reopen trading/withdrawals, that may be the best chance to get something back.
I believe that Bitfinex abandoned their plan to simply fuck over holders of BTC, because it wasn't legally sound. Bitfinex took hold of those BTC on behalf of the customers, and the owners of the BTC had no control over them, or their security. Had Finex took this route, then disgruntled BTC holders who had just lost their shirts, would flown into a litigious rage, via the British Virgin Island's court system of course, and they would have won. Bitfinex would likely have had to pay all the legal fees, and the company would face insolvency for sure.
The alternative, has been to steal from customers who were not affected by the thefts, and issue some shit-coin BFX token, in order that at least some Bitfinex customers, believe that Bitfinex intends to make good on their losses, and don't just pull all their funds from the exchange, the moment that they get the chance to do so. Under this situation, not only would Bitfinex still be vulnerable to litigation in the civil courts, but I suspect (I don't know for sure but I do suspect), there could be criminal charges to answer for here as well. However, Bitfinex are basing this course of action, on 'doing the best thing possible for their customers'; in that should the company be hit with a barrage of litigation, which they would be almost certain to lose, the company would go bankcrupt and be forced to liquidise, with customers possibly ending up worse off than had everyone just accepted the 36% kick in the nuts to begin with.
The other complication is, 'who are Bitfinex?' Registered offices in Hong Kong, which turns out to be simply the offices of a company that allows other companies to register at their address. Bank account in Taiwan, legal jurisdiction in the British Virgin Islands, and shadowy operators located all over the world, who cannot be accurately located.
My take on this, is that we haven't seen the worst of it yet. I also suspect that certain individuals operating behind Bitfinex itself, were complicit in the 'security breach'. BitGo simply implemented the level of security that Bitfinex requested. Therefore the question has to arise, whether it was a matter of sheer incompetence, or intentional crookedness, that Bitfinex opted for the security configuration that they opted for, which amongst other things had no 'freeze' function for any situation where say twice the average daily rate of BTC transactions was triggered within a single 24 hour period. As it happened, more than 65 times the average rate of Bitcoin transactions, was allowed to occur within less than an hour.
If I am right and say the likes of Giancarlo Devasini (face of a fkn crook if ever I seen one), or Raphael Niccole (previous for running ponzi scheme), were involved in the heist, but other big hitters and financial backers behind Bitfinex were not, then there are still 'honest' people behind Bitfinex, who may be the driving force behind these desperate attempts to keep the whole operation afloat, and who knows, even to return as much customers money as possible.