Indeed it's very secured and it's impressing since it's their first game. So after trying everything the last thing I can think for now is the following.
If a player modifies his checking money to 1000000000 and then someone connects to this ip, there is a chance for getting that kind of money but the chances are low. Also I mentioned something you said about the database. The databases are encrypted only in the process you can have a clear view and this means something. If we can retrieve the hidden information from the other databases maybe we could do something too. Keep up with the work people