[umanwizard]

> without actually making off with all of the gold

This is the key difference. The comment I was replying to implied that the transaction was actually completed, or at least I thought it did.

If the guy[0] didn't indeed actually benefit from the vulnerability then that is a very different story, and I don't think he should be arrested in that case.

0: not "kid" -- he is 18 which I assume is above the age of criminal responsibility in Hungary.