all the transaction coming to him is from my website "customers" can't disclose
We really need all info. Chances are it's gone but the more info you provide the better chance of finding who did it.
I mean look at what the forums did they said they made a forensic backup. They can see exactly what the "bad guy did". If I were you I would be worried that hes still in your website.
Your customer data count be in danger... I would turn off and try to figure it out.
Also I would HIGHLY suggest changing saying you will pay 20 BTC for him to "Cry blood". I can understand your anger and agree it sucks but but that could be considered a threat and with offering of money for it hard to say what all legal bad things it could be.