@OP, it's clear Doog was helping you find bugs/vulnerabilities. If he hadn't exposed this bug, you would have an open gash in your security right now.
It's also clear that Doog had no intention of stealing your money. He didn't even try for a withdrawal (he claims).
OP is long gone. I don't expect to ever get the coin he owes me.
Maybe he'll make another scammy site under another no-trust name and maybe he won't. Maybe he already did.