Good lord, why do you believe that person owes you coins?
You ran a gambling site where the numbers are supposed to guarantee you a profit.
You wrote code that allowed your users to “turn the table” on your guaranteed winnings.
It frankly strikes me as entirely appropriate to “exploit” you whenever possible as your business model is fundamentally exploitative to people who know less about statistics than you do. All this person did was show you out your own door by exploiting you for knowing less about application security than he/she does.
And yes, I believe card counting should be legal as well. You know the system is corrupt when laws protect the exploiters from being exploited!