Go back and read SB other messages[1]. After the first message, it seemed like a PR stunt by a foreign intelligence agency, with this impossible auction designed to throw people off, but all of their messages since have been designed to explain the auction process more thoroughly.

Try imagining yourself as a young sysadmin who stumbled across an entire dump of Equation Group while investigating an infection. You realize the value of such a thing, but have no underground contacts to use to fence it. You can't walk into a Chinese embassy and try to sell it, they might kill or report you. So now you have to try to get rid of the thing and maximize your return while not sacrificing complete anonymity. You don't want NSA on your ass for the rest of your life. How would you proceed?

The messages are getting a bit more desperate. They went from the $1,000,000BTC in the first message (which SB says was interpreted incorrectly), to a public release if 10,000BTC was crowdfunded, and now they want a cool $million.

One of the Q&A questions answers the "why trust us to deliver?" argument. They say this is about reputation. No delivery=no reputation. Imagine the kind of deals SB could make in the future with SB PGP key signing stuff if they delivered on this transaction. You would catapult yourself to the worlds most famous cyber arms dealer in one day.

Reminds me a bit of Trainspotters or the guy in Neuromancer who steals the mechanical talking head and fences it to The Finn. People who come across extremely valuable items with no way to easily sell. It rarely ends well.

Of course this could be all misdirection, but I'm leaning towards the much more interesting notion that this is legit. I just hope we hear about how it ends. It would be pretty boring if they quietly sold the data to some foreign service and we never learned anything more about one of the most interesting chapters in recent cyber warfare history.

[1] https://medium.com/@shadowbrokerss/