busoni, you need to shut down Poloniex now and try to make your users whole from your own funds and debt. Do not continue trying to run an exchange. Your post mortem indicates that you do not have sufficient programming ability to handle other peoples money - no mention was even made of database transactions, which are a basic "database programming 101" topic. Your proposed fix of checking for negative balances is wrong and indicates that your code is almost certainly riddled with other exploitable bugs.
Please do the right thing and refund everyones outstanding balances, then wind up your operation.
This comment was from Mike Hearn, senior developer at google.
And yes mike is right. The developer of Poloniex have no knowledge about database transactions and handle code in multithreaded environment.
Indeed. Poloniex is probably a disaster waiting to happen. All the honesty and hard work of busoni won't change that fact.
He was already warned with the XCP bug exploit and didn't learned the lesson, although he had his
get out of jail free card by being was reimbursed of the stolen BTC.
The only question here is : Will the confiscated BTC be repaid before the next disaster ?