Not that I 100% believe this narrative, but having wrote all the options code for BTC-TC, I can attest to the complexity in coding something like this, and why it is important not to rush something to delivery. Probably even more important is to closely monitor activity following launch.
A simple input validation failure (eg: allowing negative numbers to be input instead of positive numbers) could quickly turn things sideways.
Requiring manual review of large withdrawals could have likely caught this as well.
I came really close to selling BTC-TC to Ukyo a few months prior to our first notification from the SEC. I had a bad feeling about it when I realized I'd have to hand over the wallet with everyone's deposits in it. I delayed, then the SEC thing happened. Part of me wishes I'd sold (it was a year and a half of legal expenses and not sleeping at night.) but part of me knows that if I had, then everyone else would have ended up screwed.
I'm still confused why the US Gov't came down on me so hard and yet Ukyo (a Texas resident) has had nothing happen.