Unless the attacker is careless enough to reveal his identity, or puts his ill-gotten gains at risk of being hacked back, or the victims are Ethereum foundation members, your chances of restoration are slim to none.
Yes. If one party makes a mistake, or does something underhanded/surreptitious, you have no recourse. This exact situation (a bug in the DAO contract leading to a malicious actor stealing from the DAO) led to the recent Ethereum fork: https://news.ycombinator.com/item?id=14819268
