I'm 100% sure he's just abusing some bug he found, Dev's just can't find it.
One would think the logical thing to do is to stop betting. As I said earlier, they claim to have fully vetted all code, while doing transfers and payouts, along with diagnosing the original problem, all within 12 hours. I don't think that's possible. At least, not possible to do it well.
Maybe they'll deny mateo's payout and declare him null and void. But DB as a site is finished. That's one certainty. Wouldn't surprise me if mateo had a 'shocking' run of bad luck now.