If I were he, I would:
1. Analyze the past transactions to work out how much has been lost to errors
2. Figure out how much is recoverable by fixing the broken trades, i.e. how much has not yet been withdrawn, and also decide whether this is ethical
3. Figure out how much is not recoverable, and whether the business has enough reserves to cover the losses
4. If not, figure out if he can prop it up somehow or whether he must declare bankruptcy
5. Overall, limit his business's exposure to lawsuits down the road, either people who disagree with the outcome of (2), or people who feel robbed due to the exchange's downtime and freezing of their BTC during a crash, or... etc, the richest people will find many reasons to sue
6. Plan how to restart the site without bugs or bad publicity
To me, that (2) is ethical or fair is not obvious. It is a very difficult situation. See (5).
One way to cope with the situation would be to
1. undo the faulty transactions (even though it would lead to a situation where someone's balance would be negative if they withdrew too much because of the bug)
2. FIX THE BUGGY SOFTWARE
3. "kindly" ask the people with negative balance to pay back the extra they have withdrawn (which is, likely, a criminal offence - and bitcoin-24 has their ip address, email address, bitcoin address they have withdrawn to, and possibly bank account number, and possibly phone number)
4. continue operation
5. introduce transaction fees to cover the losses, of which will inevitably be some. It might be possible to continue operation, for now, with negative total balance - it's not likely that everyone withdraws their funds at the same time. (After all, banks do the same thing.)
Oh, and step (0) and everywhere in between would be to COMMUNICATE - I want to know what's going on, what's going to happen to my balance, will the site ever come up again, etc.
I suspect that many won't trust bitcoin-24 after this. But then again, other exchanges have been faulty/hacked, too, and have recovered.