There's intent, deception, and damages so it's definitely fraud. This isn't a mundane matter of creatively using someone's API in a way they don't like. He came up with a scheme to extract money from them. The ToS is the contract governing payments in this case (IIUC).
It's the difference between violating a no skateboarding sign in front of a shopping mall versus a no trespassing sign at a military base. They're both "just signs", right?
Oh I don't deny what he did is most likely a ToS violation. And under those terms, he should probably be forced to pay back the money.
But I don't see how it's fraud in the criminal sense. That's just my judgement as a citizen, not a lawyer. All I see is the shopping mall shaping criminal law to its own benefit.
As for the military bases, yeah, stay away from those, kids.
The point is that it doesn't matter what you call the contract. You're thinking "oh that's just a sign" (ie ToS). Your error is that not all signs are equal. The 8 million dollars is the military base in this analogy. Being prosecuted for violating this ToS under these conditions is not interchangeable with others.
Fraud is just any time you intentionally deceive someone for material gain. Even without the ToS this would presumably still qualify as fraud. The ToS just makes it more straightforward to argue (IIUC, IANAL, etc).
A decent rule of thumb is that if your hack or neat trick results in money in your bank account that the other party wouldn't have paid out to you had they been aware of what was happening then you are almost certainly committing a felony of some sort.
I guess forging documents and selling you a house which I don't own shouldn't be an actual crime either? The patterns of behavior in both cases are functionally indistinguishable.
It's the difference between violating a no skateboarding sign in front of a shopping mall versus a no trespassing sign at a military base. They're both "just signs", right?