Let say company x makes massively multiplayer online strategy games. The game y is updated adding a feature z, but developers forgot to add server-side verification or it was bypassed (using alternative UI). Update allowed users to double their units as many times as they like. After about a day this bug was fixed. A lot of members had abused this bug - some by accident(?), others as much as possible. Damage has been done and extra units still remain.
The game has a cash shop where speedups, elite units, etc can be bought. Some members have spent hundreds of dollars to be among the best and played this game for several months if not years.
I want to know : what can be done, if rollback is not possible?