It's pretty grey, there's the computer abuse act or w/e. But it's quite selectively enforced.
I don't the US gov is gonna go after him for hacking a scam group AND he provided details to the authorities. Now, if he hacked them and used the stolen credit card details? Who knows.