Hacker News Reader

The indicated that they emailed the exploiter and basically told them to stop playing. They have the right to refuse service, it was circumvented by making new accounts. I don't see any reason they would need to pay after refusing services.

View on HN

Basically would be the key word in your description of their actions. As they do not mention actually telling the user to stop playing. They only mention "demanding" their bitcoins back. Demanding something you are at that point probably not entitled to from a user of your service, and informing them that you have decided to refuse future service to them may appear basically the same, but they are in fact not.

"We reached out to Hufflepuff via his bitcointalk forum account and demanded the return of the coins, however this backfired unbelievably hard. "

Reply on news.ycombinator.com