they came to the wrong conclusion that someone who bought a kill switch domain, would have been one of the hackers. when it fact the kill switch was firewall check (look for 502 rather than 404) and the person who bought the domain kill switched it for everyone.
Where did you come to the conclusion that they think he was one of the hackers? Neither the link, nor the Telegraph article said anything like that AFAIK.
Sucky journalism strikes again.