The way I read the article, the “worth millions” is the sum of the ransom demand.
The funny part is that the exploit is in the “smart” contract, ya know the thing that the blockchain keeps secure by forbidding any updates or patches.
Then what would you do with it? Is it purely for clout? “Hey guys, look, I got an image of this monkey.” Yes monkeys are amazing, but you don’t even own the picture, so what’s the point?
I mean low key it’s supposed to be a receipt that can’t be copied. The receipt being slapped onto an image is what most associated with NFTs but it’s more just like a code that provides proof of purchase/ownership because you can trace the history on the block chain