Gambling site 888.com has been fined a record £7.8 million for failings that allowed thousands of compulsive gamblers who tried to stop to keep betting.
Customers who had opted to self-exclude - asking the bookmaker to block their bets - were able to deposit a combined £3.5 million and gamble for a further 13 months because of the site's technical failures.
Among the 7,000 customers who retained access was one who staked more than £1.3 million, including £55,000 stolen from their employer.
The problem gambler was able to place a large number of bets and gamble on average three to four hours a day.
The Gambling Commission said 888 failed to "recognise visible signs of problem gambling behaviour" as it issued the unprecedented fine.
The outright fine to fund a socially responsible cause's attempts to tackle gambling-related harm.
The repayment of deposits made by self-excluded customers.
Compensation to the employer from whom gambling money was stolen.
The Gambling Commission said 888.com's attempts to protect potentially vulnerable customers were "not robust enough" because of "significant flaws" in its site processes.
Sarah Harrison, the commission's chief executive, said: "Safeguarding consumers is not optional. This penalty package of just under £8 million reflects the seriousness of 888's failings to protect vulnerable customers.
"The 888 sanction package will ensure those affected don't lose out, that the operator pays the price for its failings via a sum that will go to tackling gambling-related harm, and that independent assurance will be given to see that lessons are learnt."
The commission has also ordered an independent audit of 888's customer protection processes.
888 said it had cooperated with the commission's review and accepted its conclusions.
The firm said it is "committed to providing players with a responsible as well as enjoyable gaming experience".