Uber typically contracts and pays security researchers through a "bug bounty program" to discover vulnerabilities before hackers do. In this case, Uber directed the hackers to join their bug bounty program. Then, they required the hackers to sign NDAs before Uber funneled the $100,000 to them in bitcoin.