I don't see anything to indicate they are converting directly from sha2 to bcrypt. When the user logs in next, if it matches the sha2 hashed password, insert the bcrypt hashed password in the bcrypt hash password field and use that from now on.