Concrete examples :
Someone making API requests through a banking platform, withdrew many times in succession, and through some miracle bug they all went through.
Someone unaffiliated with a business, deletes a its entire database with an unintentional request.
Someone purchases twenty video game Steam codes at -99% through one transaction.
etc.. All of these are one-off mistakes, where a bug does exist, yet it is unintentionally used in a way where this single error causes notable damage to the business. Are they legally allowed to confiscate any financial gain the user has made? Maybe even sue if the confiscation is not directly feasible? Does the user have no right to any of the gains made through this error? And are they liable for any damages caused if any?