I think their mistake was to not halt betting when the issue was discovered.
Mistake? They were asked repeatedly to do just that, even before the mass exodus of investors. The fact that they didn't and blissfully claimed that the issue has been resolved is as much of a smoking gun as about a dozen other facts in this story.
They received the advise to not allow bets to continue. They made the business decision to not stop bets as they were likely trying to avoid any downtime. I think they were hoping that allowing betting to continue and not stopping withdrawals would allow them to maintain their credibility. It was a calculated risk that did not work in their favor.
Or it worked very much in their favor. I was ready to give manl the benefit of the doubt as he seemed to be a reasonable bloke before this whole fiasco. But the way he mishandled this situation is beyond belief, even if you assume that everything he said was true. He's sitting on a $3m pile of OPM and what's the first thing he does after the site is compromised? Hastily rolls back the code and insists everything is great. Starts issuing half-assed refunds. Yells at anyone doubting his decisions. Closes chat and then the official thread. Proceeds to lose 80-90% of last investors' coins to a freaky lucky whale. Did I miss anything? Did he do anything that was even remotely rational?
I'm not even sure what he could possibly do or say to try to extract himself from this shit, if he'll be at all interested in that when he cools down. Maybe start with publishing mateo's lucky seeds and rolls.
From a financial standpoint yes, it worked out in their favor if you believe they were behind the "lucky whale". At this point saying that this is the case is pure speculation. Until the database can be audited (if this would happen, IDK) we really cannot say this as a fact. From a reputation standpoint it did not work in their favor.
I am curious to know how much of their own money they had invested in the site/bankroll, the estimated gains by mateo et el, and the estimated amount of money they refunded investors and victims of the nonce issue. I think this would give a better picture as to what they were able to potentially have scammed and what the ROI on their scam was. It would also paint a picture as to what their potential profit could have been if they had continued running as a legit site.
Their site is showing ~91k BTC bet (over it's lifetime?), this would have an EV of ~910 BTC profit for the bankroll, and an EV of ~91 BTC for their 10% commission on bankroll profits. Assuming they have been in operation for 6 weeks this works out to ~15 BTC per week, or ~780 BTC per year, or ~$390,000 per year before expenses.