Olle,

while your evidence looks good, there is no way you can hold back the money he deposited. Allow him to withdraw only the money he initially deposited, keep the winnings and ban him from your platform. That's the only right thing to do.

Thanks for clearing this up, though. "Victims" here often only tell half the story, but when it comes to "confiscating" funds which never were yours in the first place, I'll always side with the player. You have no right whatsoever to claim ownership on funds deposited (even though ToS might say otherwise, but this is pretty much irrelevant), and keeping his money would be a clear sign that you cannot be trusted.