Just asking, I really do not know what is the best thing what I can do now.
Sounds like you're caught in a moral dilemma...If I were you, I'd return the money, not because the exchange has my KYC and IP so, they could easily find me if i didn't return the funds, but because I believe in karma, plus if you want money, you gotta earn it.
And something like bug bounty can´t be claimed in this situation?
Is the exchange offering a bug bounty? If not, then no, you can't claim anything since you didn't find a bug in their system that can be exploited.
The transaction refers to a transaction on the blockchain but with diffrent numbers, still thinking how it is possible.
It was probably a human error, just report it and they'll probably give you a 'thank you note' and you'll feel good for the rest of the day for doing what was right.
Btw, good read:
https://www.theguardian.com/money/2012/jan/09/bank-account-250000-error