Feels more like a system design failure than malice

Profiting from a design failure indefinitely isn’t malice, it’s negligence that can still be considered criminal.