You can see their emails at the bottom: those are universities/research institutes domains. You can be sure _they_ did not actually spend that themselves.
Breaking MD5 for the Flame malware probably set the NSA back millions when you sum the person-hours and CPU time together.