If the issue still exists (seems like it does) they should first shut the game or all affected games down and fix it. Otherwise the alleged hacker can come back with more convincing KYC and perhaps a smaller less suspicious win, or publish the exploit, or do something else that's not very pleasant. Releasing an explanation is a bit tricky - might disclose more about their backend than they would want the public to know.