A whitehat hacker is holding $320 million in drained Bitcoin until developers prove they patched a fatal network flaw