He should have already reported this theft to the Swedish police and the hosting ISP, 247. A backup of the server should have been frozen as forensic evidence.
But we have seen no evidence that these common practices were followed.
The admin will probably wipe out the server with some pool rebuild next and claim that all evidence of the intrusion was lost.
It's not just a lack of transparency. It is negligence and fraud.
First step is that the server should have immediately been unplugged and taken offline, air gapped and NOT backed up.
Police contacted as this was occurring would be the next logical step.
A backup of the server could trigger some a script to help clean the hacker(s) tracks. That's going under the assumption that there was a hack.
In any event the lack of clear communications from Admin is concerning but I wouldn't say we should jump to fraud just yet.
We all have to unfortunately sit back now and let the investigation run its course....
If it was a hack, then I hope they get caught, are forced to return every dime and then fry the scumbag. If it was an Admin exit strategy, then the same.