Wasn't the attacker on PD only able to withdraw 40 btc before his misbehavior was noticed and all his other withdrawals were blocked?
On the account where he was obvious about it, sure.
I wonder if he had other accounts that he used before that, where he won a bunch in a less obvious way?