I’ve rebuilt databases from logs and snapshots several times.

It should be pretty easy (and by easy I mean labour intensive and exhaustingly detailed) to pick a snapshot, identify real money in, then undo all skin/item purchases and revert all money to the original amounts.

That’s kind of best case scenario to the user base. Nobody gets screwed.

It’s also possible the hackers didn’t just modify the tables so there’s an audit trail, or they have change data capture enabled, or can replay the database transactions out of the box.

This is all very stack dependent.