This situation is almost identical to what happened to PrimeDice several years ago:
https://medium.com/@Stunna/breaking-the-house-63f1021a3e6dYou guys are lucky that you discovered the exploit so fast and lost only 3 BTC. PrimeDice lost 2,400+ BTC because of the infamous hack.
I wish you best of luck with your investigation! Don't give a penny more to those disgusting buggers.
But what happened with PrimeDice did not lead to dramatic lost (in fact nearly $1 mil. lost) due to low price of bitcoin at that year.
The case of PrimeDice will turn to worse lost if it happened when bitcoin stood at $19k.
Losts in early phase always bad because funds for developments, promotions, and more things lost for stupid things and bad guys.
There is a development bug. Now we can say, they paid 3BTC to find this bug. I hope it will not affect to future work of this casino.