Is this even illegal? Or just frowned upon? It seems this is just one big game, you find the weakness and you profit.
The practical challenges to tracking hackers or 'hackers' stealing digital currency mean you don't see regular prosecutions, but the ease of getting away with it shouldn't imply legality.