1. Stop all deposits until the issue is resolved.
2. Stop all withdrawals and then process all those that were already made - manually.
3. Only then try and fix the bug.
4. Reopen with no fees and some other nice things for customers.
All steps should be accompanied by a statement explaining everything thoroughly. Even that course of action wouldn't necessarily restore confidence, but it wouldn't destroy their business.
If they're not doing this, it means something else is up and they are not to be trusted. At this point, their business is done anyway (unless they do the steps above like right now). The question is, will people see their BTC. My bet is not. But who knows.