That seem's like a lot of work for $5000.... Some Blackhat burning 0day for giggles?
It's also very impressive that the BT community caught them so quickly.
Which is to say, that it is entirely possible (I'm not going to presuppose how likely) that this has been known about for some time, and used for other nefarious purposes in a manner that wasn't so "easily" detected (the existence of a master record of all Bitcoin transactions makes it much more likely for this to be found than people exploiting it in some random app).
It could be that somewhere right now, in dozens of coffee shops throughout Eastern Europe, South America, and Asia, a group of collective hackers, each unaware of the existence of any others, read this blog post and uttered their linguistic equivalent of "Son of a Bitch".
Though they probably could have stolen more money by waiting until they had collected more private keys, there was a risk that someone else would find the same keys and steal it first.
One somewhat fortunate consequence is there will now be lots of people actively scanning the blockchain for these sort of vulnerabilities thus they should be found extremely quickly, which is great for everyone except the unfortunate first victim. Hopefully clients will specifically test for this as well.
Also note that you can avoid this class of vulnerabilities by not reusing Bitcoin addresses.
It would be great to see it pushed down to the client, though. Easy way to avoid a simple cryptographic tripwire that's likely to recur if the BTC clients continue to rely on library sources of randomness.