I think their mistake was to not halt betting when the issue was discovered.
Mistake? They were asked repeatedly to do just that, even before the mass exodus of investors. The fact that they didn't and blissfully claimed that the issue has been resolved is as much of a smoking gun as about a dozen other facts in this story.
They received the advise to not allow bets to continue. They made the business decision to not stop bets as they were likely trying to avoid any downtime. I think they were hoping that allowing betting to continue and not stopping withdrawals would allow them to maintain their credibility. It was a calculated risk that did not work in their favor.