Needless to say, doing either of these things would be legally dodgy, although it's certainly a legal grey area that if one of the people who was scammed out of money had bought a controller in this run and was to not pay, that could be seen as an attempt at a self-remedy for the previous theft...