It's the same group that rescued funds during The DAO attack so they have a good history of benevolent hacking.
They are just going to deploy new multi-sig contracts with a fix and make the original owners the owners of the new contracts. Pretty easy to do. They are actually paying for the gas to do the fix using donations they received for their work on The DAO attack so the original wallet owners aren't even out the gas the fix would charge (which isn't all that much but it's nice that they are being made completely whole).
The exploit allowed anyone to reinitialize a multisig contract with themselves as an owner because the constructor was a public function. These contracts weren't "fixed" like they were supposed to be.
The white hats will deploy a new contract without the faulty constructor with the old owners reinstated. These newly deployed contracts will have all the same information the old ones did but won't be exploitable.
They are just going to deploy new multi-sig contracts with a fix and make the original owners the owners of the new contracts. Pretty easy to do. They are actually paying for the gas to do the fix using donations they received for their work on The DAO attack so the original wallet owners aren't even out the gas the fix would charge (which isn't all that much but it's nice that they are being made completely whole).