How hackers are making millions — legally