[da_chicken]

Maybe.

Or maybe they took what they know to sell to the black hats.

[nomel]

This is legal, correct?

[da_chicken]

If you can reasonably know they're criminal? No. If you sell an exploit instead of knowledge of a vulnerability? No. If they pay you with something they stole? No.

But otherwise? Usually, yes.