The part that shocks me the most about this attack is the userbalances table. What a terrible decision to give up on securing the integrity of your most important data in the name of performance.