The complaint already says how: after busting Chronicpain in a CD, he turned over his SR1 moderator/admin account, and then Force used the mod/admin ability to reset passwords & PINs to log into big vendors' accounts and transfer their balance out of SR1 to his own Bitcoin account.