You do not need to wait until you are sued or prosecuted to get advice from a lawyer.
They say "we consider Snaphax to be an unlawful circumvention device under 17 U.S.C. ยง 1201(a)(1)."
They are implying he would be subject to lawsuit and/or criminal prosecution if he keeps distributing the software.
How likely is that to happen? How risky is it for the guy? How expensive might the defense be, and how much pain might this be for a weekend project?
I'm not really sure. But you know what class of people are expert at answering questions like that? Lawyers.
But, sure, if the poster want to keep it up anyway cause you think it's bullshit and are willing to see what they do next, certainly that's another option. It's potentially a brave and commendable one.
But I wouldn't do it because a bunch of people on HN who don't know what they're talking about told me that since they didn't use some special magic words in the letter, there's "nothing a lawyer can do", what?
A lawyer can analyze the facts of what you have done, and provide you with advice as to whether it is likely to be found to be an anti-circumvention device under the cited section of the DMCA and, if so, what the likely consequences of that are and what steps you can take to mitigate any exposure you might have in that regard (including, if there are any, steps short of taking down the existing offering.)
Of course, you could wait to see if they actually file a suit rather than having a lawyer look at the C&D, but if you do that, then there will be less, not more, that a lawyer can do for you.
At this point in time, OP can take down the repo (but not the 115-and-counting forks thereof), or modify it (someone suggested removing keys issued by Snapchat), or not. How will this set of options change if Snapchat file suit? Of course one must respond to a suit, but couldn't one's response be "ok we've complied with all requests"?
If you're telling me that the suit could allege OP owes Snapchat money for his/her misdeeds, that's true, but it's always true, even after one complies with the sort of namby-pamby "C&D" we see here.
Without specific answers to many of the foregoing questions, this message amounts to asking OP to forego all use and value of work that OP has personally performed, merely on Snapchat's say-so. So, actual meritorious C&D's require some actual work on the part of the sender. This letter took some knucklehead five minutes, so that's about what it's worth.
C&D's are usually courtesies to avoid...
...the expense of an actual lawsuit. In many cases a vague and overbroad (see above) message is mere bullying, attempting to imply threats that would be impossible to articulate or enforce. Papers filed in a court are held to a higher standard, and penalties are enforced. The fact that OP might be well-advised to retain counsel in response to this turd is an indictment of the USA legal system.
Assuming the posted letter is complete, a lawyer can't really do anything at this point. The letter (or is it actually an email?) doesn't invoke any requirements one is bound by law to obey. One might even say that it's careful not to do so, so I suspect that even though the "Director of Operations" signed it, it was originally written by a lawyer. This would actually be a useful form letter for people who have their underpants on a bit too tight: even if they send it five times a month, it doesn't create any sort of SLAPP liability or anything else that will damage Snapchat in a legal sense. Of course, giving someone 12 hours to comply with anything looks like amateur hour. tlack isn't the only party reluctant to run up billable hours.
IANAL. If I were, I would recommend you start paying me or one of my colleagues to talk with you immediately.