It's one thing to have a security breach occur, draining BTC4,000 from the site. To continually allow the site to run normally for over 14 days with users unaware of the gravity of the situation is not just irresponsible, but borderlines criminal negligence. You were aware of the situation, yet you allowed deposits to continue.
Yep. TF has some serious legal exposure if he lives in a western nation (did I read somewhere that he resides in Australia?) and his identity can be ascertained. Completely separate from the question of whether this was a hack or a scam, TF's actions after the "hack" -- deceptively allowing his customers to put further deposits into an insolvent "bank" when he knew he could not repay them in full -- are likely a violation of the criminal laws wherever he resides and almost certainly exposes him to civil liability.