:rolleyes at "nothing illegal"
Technically, it's not. I guess it could be under some hacking laws, but I don't think I've seen any cases about individual virtual personal property being taken to court, just DCMA violations.
However, it is pretty much the definition of "black hat".
There were arrests and prosecutions in relation to the theft of virtual goods in Habbo hotel.