Bitcoin Forum

This morning I stumbled across a error in Bitbook.biz that allows BTC to be transferred out while a bet is pending.

Basically what I did was I placed the following bet:

http://imageshack.us/scaled/large/703/p9uk.png

Looks like I lost correct? No, I found that BTC can bet transferred between BitBook.biz accounts even while the bet is pending! So once I saw that my one pick lost I transferred the BTC to a friends account who is also on Bitbook.biz. (My friends account has been blacked out due to privacy, but Bitbooks.biz has been made aware of all accounts associated via PM.)

http://imageshack.us/scaled/large/834/i9z0.png  

From this account I simply sent the 4BTC out of the Bitbook.biz website and it was as if I never placed the bet
http://imageshack.us/scaled/large/543/u5q2.png
Blockchain info: https://blockchain.info/address/17kceCdAeEiQ2fgZz5nxjzhoi9TdhjgSGs

After discovering this error I decided to test the system to see if I was about to place bets on account and then send the BTC out of the system, but still get paid. I wanted to cover my butt in case the accounts were frozen so I informed a trusted member here on the Bitcointalk.org website of what I was doing so if my funds were frozen Bitbook would refund my funds frozen into the accounts.

I sent a additional 15BTC+the 4BTC from my error into Bitbooks.biz for testing.
https://blockchain.info/address/15dBLXY5v1bDF5KN37x47K4RaiPsoVoUbu
(Later I sent a addition .1BTC for testing withdraw.)
https://blockchain.info/address/1L8XoWuf35GinnnBTAYPEJaN1xfZhpVDH5

I then started the accounts bet2win-bet2win1-bet2win2-bet2win3-bet2win4-bet2win5-bet2win6-bet2win7-bet2win8 and bet2win9. With these accounts I was able to place my pending bets and then use the same transfer option to fund the other accounts.
 
This is what the accounts look like on all 10 accounts:

http://imageshack.us/scaled/large/703/w85o.jpg

Once I had placed all the bets I sent the 19.1BTC to the account "Wallet2Win" to be transferred out.

At this point Bitbook.biz froze all the accounts with the 0 balance/19 pending, including the Wallet2win funds to be transferred out. I never had the intentions of ever stealing any of the fund that were frozen, I was simply checking the system.

I am asking Bitbooks.biz to please refund my 15.1BTC (4BTC of that was lost due to losing that Parley bet. When I make my bets, I pay my bets.) Any bounty that can be tipped to me for showing this error would be greatly appreciated.  I have no concerns about getting my BTC back because I honestly believe Bitbooks.biz are ran by stand up people. (And I have already lost 20BTC in bets there between my group of friends)

Below is my COVER my Butt policy:

This is a series of e-mails I exchanged for "information" escrow to the owner of Satoshibet.com (stand up guy, I won .443BTC into over 20 and was paid.)

Re: Great site!!!!!
« Sent to: addi on: Today at 01:27:49 PM »
Quote  Reply  Delete  
Yes thank you.  Would you mind if I use you as escrow for information I just found out so it doesn't look like I am trying to steal BTC from a error I just found on a website?

I don't want them to keep my 19BTC (it is in the process of being sent out of their accounts) because they though I was trying to rip them off, I am going to alert the site owner once I see that the site actually has a flaw?

Just worried they may have to manually approve the 19BTC (which they very well may not) and they will think I am trying to steal.

I am going to ask them for a good size bounty of course because it is a major error.
_____________________________________________________
Re: Great site!!!!!
« Sent to: BayAreaCoins on: Today at 01:34:17 PM »
« You have forwarded or responded to this message. »
Quote  Reply  Delete  
Is it a bitcoin gambling site? What's the flaw?
_____________________________________________________
Re: Great site!!!!!
« Sent to: addi on: Today at 01:41:17 PM »
Quote  Reply  Delete  
Yes it is a gambling website, you have to swear you will not exploit it. I want to tell someone so I am not doing any wrong. It is on bitbooks.biz I am going to alert the owner once I see there is actually a problem.

It is a way to place bet but yet transfer the money out in case you are going to lose, just a flaw in their system.

I just want to make it perfectly clear that I have NO intentions on keeping the BTC earned from this.
______________________________________________________
Re: Great site!!!!!
« Sent to: BayAreaCoins on: Today at 01:45:23 PM »
« You have forwarded or responded to this message. »
Quote  Reply  Delete  
Sure, noted.
_________________________________________________
Re: Great site!!!!!
« Sent to: addi on: Today at 02:11:38 PM »
Quote  Reply  Delete  
Gosh I am nervous that they keep my 19BTC but I had to try the flaw on a large scale to see if it worked!  
(just threw up I am so worried lol, I placed like 200BTC worth of bets with 19BTC.)

Thank you very much BTW man I will keep you up to date



Here is my post on my Free Escrow service:
https://bitcointalk.org/index.php?topic=257222.0

Well that is my findings and I hope I have proved beyond a shadow of a doubt that my accounts frozen/pending withdraws were not of ill mannered/nor would I have stolen the coins.  Hopefully this is clearly enough written so I can recover my test BTC.

It is important to myself that I build a positive rep here on the site, especially since I plan on Buying/Selling BTC face to face as a store front.

My frozen BTC can be sent to 1EgN9QatDmmxEiBDxVbqj8cWrV2AFFpdkb (this is a bitbook.biz account as well.)

I was refunded in full.

Thank you for your reading pleasure!
BAC

Watching how this plays out.

To be honest it was good of you to do this, BUT I would've PMed them or contacted them before hand so that they could fix this before other people found out...now the problem might get out of hand bigtime if it has not been fixed yet.

Agree, the information has been taken down because I, like Bitbook.biz am a stand up guy.  

Fingers crossed they can bounty 20+ because that would put me back to even for betting (20+15.1 of course)
I feel like that is totally fair, I could have sold this to someone for 30BTC with no problem. That is only the cost of 2 bet errors!

Kingofsports can you confirm the problem still exists so someone can't just say "He was 14 post, SCAMMER SCAMMER *blah blah blah*"

(I have PM'ed them several times trying to explain, but my writing skills are not the best  :'( )

All of my BTC is in exchanges in USD form at the moment. Sorry I cannot help you out atm.

No problem, it is well enough documented I am not worried about it! If I was worried about Bitbook.biz I wouldn't have bet with them in the first place!  But come on let's get this problem fixed so I can share what I found (unless paid off to be gagged)

Alright, so here are some facts about the situation:

• BayAreaCoins believed he had identified an exploitable flaw in BitBook
• BayArea did not notify us or attempt to prove the exploit on a small scale (as someone not trying to scam us would have)
• Rather, he immediately attempted to place a large number of big bets on which he thought we were being free-rolled
• We very quickly detected his activity and locked his accounts
• Only after he realized that his scam wasn't working did he contact us
• The potential exploit he is referencing does not exist anymore and there is no danger to other users
• Bottom-line: BayArea attempted to scam us (for hundreds of BTC) and failed

It's also notable that BarArea joined the forum just yesterday and has already been accused by other members of being a scammer (one of his first actions was to create an escrow service -- sketchy)

We've currently got 15 coins that he is asking for. So then, what's the right thing to do? Return them? Donate some to the Bitcoin foundation? Seriously, we're open to suggestions from the community. What do you all think?

If I was interested in scamming you I would have continued to bet on the Account BetBetBet and transfered out like I did the first time

I even PULLED DOWN THE PROBLEM SO YOU COULD FIX IT.

This is a PM from KingofSports


I escrow the information with Satoshibet.com own for this EXACT reason. Please check the times and you will see

The messages that you posted are time stamped after we caught you and locked your account.

Please do not make me involved in this. I am not the owner but in this case I would refund with the possiblity of banning if he truly did not have ill intentions, however that is not my decision to make. However, donating his funds or otherwise when he seemed to go out of his way to make it known he was trying to fix an error would be a bit of bad publicity. However, I do not know the timestamps on when it all happened. If you froze his accounts and then he came on here telling people about it thru PMs and sorts then that looks bad on the player, because then it looks like he played the "I was going to tell you when I was sure of the error!" game.

Time stamp the information I sent to everyone else with the PM's/Posting on my free escrow about the problem...
Time stamp "Free escrow post"  https://bitcointalk.org/index.php?topic=257222.0

The calling me a scammer was posted here:

https://bitcointalk.org/index.php?topic=256606.0

Here is proof I actually won what I won:
as seen: https://bitcointalk.org/index.php?topic=256542.20

July 16, 2013, at 05:14am PDT
Amount Received

15.00 BTC
From Coinbase (transfers@coinbase.com)
To You


My first series of bets was on the Williams game I believe all the way for 1 hour+ my PM's with escrow information were WELL BEFORE being frozen.  I am smart if I wanted to steal I would have continued using the Betbetbet account NOT spamming accounts/Escrowing INFO. DO NOT GIVE MY BTC AWAY I have to make a house payment on the first

Thanks King.

The timing of his actions make it very clear that he was not interested in helping fix a problem. He only reached out to us when it was clear he had failed.

Re: Great site!!!!!
« Sent to: addi on: Today at 01:27:49 PM »
Reply with quoteQuote  ReplyReply  Remove this messageDelete  
Yes thank you.  Would you mind if I use you as escrow for information I just found out so it doesn't look like I am trying to steal BTC from a error I just found on a website?

I don't want them to keep my 19BTC (it is in the process of being sent out of their accounts) because they though I was trying to rip them off, I am going to alert the site owner once I see that the site actually has a flaw

Just worried they may have to manually approve the 19BTC (which they very well may not) and they will think I am trying to steal.

I am going to ask them for a good size bounty of course because it is a major error.

_______________________________________________________________________________ ____________________________
https://blockchain.info/address/1L8XoWuf35GinnnBTAYPEJaN1xfZhpVDH5

Compared to the .1 sent to the account Wallet2Win (which is the frozen wallet with 15.1BTC of MINE) You will see that I am in the right, I even pulled the information down so you guys had a chance to fix it. Please give my coins back or contact Addi. I contacted Addi WAY before anything was ever frozen just to cover my ass


_______________________________________________________________________________ _____________________________

If I had any intent of scamming I would have continued to do what I did on the account Betbetbet, that is obvious for ANYONE who is DECENT with a computer.

I didn't contact you first because
A:I wasn't going to steal
B: I escrowed the information AND posted about it https://bitcointalk.org/index.php?topic=257222.0
C: I do not ever want to "Cry wolf", I want what I say to be taken in a serious manner

I did NOT fail at taking my 4BTC back from my 4 bet parley, I went above and beyond even removing the "How to Post" so you guys could fix your problem

And you taunt me with my own coins? What kind of site owner is that "So then, what's the right thing to do? Return them? Donate some to the Bitcoin foundation? Seriously, we're open to suggestions from the community. What do you all think?"

You should match my PM/Post/block chain info up and you will SEE that my account was NOT frozen before I start reaching out to people.  I am a positive person and never have had to steal anything IN MY LIFE. I will NOT start today, I am here to buy/sell BTC cash in person in SF area.

What scammer even takes a picture of a 0/16 pending error, ANSWER: None

Either keep his coins or donate them to charity.

Give his coins back, I will serve as a witness on his behalf.

Release what time you froze the account because the blockchain of .1 sent to Wallet2Win was approved before being frozen and the PM's/post I have linked are WELL BEFORE the .1 was posted.

You can't lie about blockchain. 

I am prepare to use online arbitration. All of my numbers match up jack

uvwvj:

If you match my blockchain .1 transfer with the PM's/post on my escrow site you will see that I was bringing this to everyones attention far before being frozen.  

Thank you for your honesty, I am so disappointed with how Bitbook.biz has handled this.

I was actually pretty pumped when I get praise from Kingofsports.

Edit:
I do NOT deserve a scammer tag. Please match up all my info before associating that word with me. It is obvious it all matches up and check my escrow information

1H7WqHzKsuHAd2bMhN16hBCAEtsJ31EfWK

I did not praise you, I wished you luck and said they would appreciate you telling them of the error. I do not know all the details and am staying neutral in this matter. I hope the outcome is one that is satisfying to both parties.

By your own account, you say that he tried to scam you.

If you don't return his coins you are stealing from him.

No?

And I even removed the information until the problem was solved. I feel that I deserve not only my BTC back, but a healthy bounty for bringing this to your attention.

KOS I fully understand man, I will not involve you any further.

All I am saying Over and over again is the .1 block info HAD to go through before the freeze. My PM's/PUBLIC POSTS are way prior to the .1 deposit.

At this point I am happy with the 15.1BTC, I can not believe you are treating someone who has played over 20BTC with you guys this way. I made you aware of a serious situation, even explored the problem on my own. With the promise on the board publicly before the shit hit the fan of returning any and all funds.


He deserves a scammer tag if my coins are not returned, I am ready to take full legal action again him and/or their organization.

Alright, this has gone far enough. You tried to scam us and you failed. It's okay. We're not mad at you, but you tried to scam us. It happened.

We'll send you the 15 BTC in full because we want everyone to know that BitBook always makes things right, even with a scammer, but we hope that this thread will serve as a warning to anyone that considers doing business with you.

That was posted at 6:44am my time

This was sent at:
July 16, 2013, at 07:05am PDT
Amount Sent

0.10 BTC
From You
To 1L8XoWuf35GinnnBTAYPEJaN1xfZhpVDH5

It was received by my Bitbook.biz account at 7:28am https://blockchain.info/address/1L8XoWuf35GinnnBTAYPEJaN1xfZhpVDH5

I sent my PM's before all of these but the public can't see that. But these are ALL THINGS THE PUBLIC CAN SEE. I posted publicly before you froze the BTC

Edit:

Don't forget my .1BTC fuck face

It is 15.1BTC can be sent to 1H7WqHzKsuHAd2bMhN16hBCAEtsJ31EfWK  Post the block chain when you do

And for the record I swear on my fathers life I wouldn't have stolen a dime from you. I wouldn't have demanded a bounty or anything, I would have appreciated a bet or two maybe a BTC or 3. I would have NEVER said "should I keep their coins or donate them"

I aint mad at you either, glad you got a free fix on your site

Not only has this person gone out of their way to help you, and prevent you from losing lots of coins, but now you're branding them a scammer? If anyone is the scammer here, it's bitbook.biz. I will no longer be using your services because of your reaction to this.

Computer people get offended when you show a flaw in their system... I understand.  But I mean seriously... think about it... I am here to do FACE to FACE transactions. Why in THE WORLD would I want to steal 100's of BTC.  I would be so scared of getting shot in the face doing a meeting. I am a paranoid Libertarian American, there is no amount of money that is worth me sleeping any worse at night than I already do. I was honestly trying to help.


Thank god for the smooth words of The Dude, I will be sending you .1BTC when I get the 15.1BTC for your awesome Dudeness

15.1BTC refunded.

https://blockchain.info/address/1H7WqHzKsuHAd2bMhN16hBCAEtsJ31EfWK

Enjoy the free fix you unappreciative bastard, next time I will find someone who values my information a little bit more than making me beg to get my BTC back.

The dude abides man.

I found Bitbook's response to be very un-dude.

Word to the wise:

Email them.. If they don't offer shit..Or don't act civil.

EXPLOIT IT.. Forget your values because if they don't want to be civil about it.. They deserve to lose it all..

Lol, I approve of this method of solving problems.

So looks like the error is fixed and I am ok to use the site?  I really enjoy betting with them :)  Recommend giving the coins back... Always take the higher path.

That was the point, I didn't. If I was trying to I would have kept it very quietly going along in my accounts that I have moved plenty of BTC through. Instead I took a look to see if it was a potentially fatal error to the website,

People remember when you have your BTC on file with someone their system needs to be secure.  I have shown the lack of thought that this site has put towards their infrastructure. If I was a bad guy and drained their accounts do you think all of the people with accounts on the site would have gotten their BTC back?

No. Invest your BTC wisely people.

(Your dudeness, you should have the .1 I sent you by now.)  

Bitcoinsucker: It was never not ok to use the site, but just careful where your BTC are kept. Needs to be safe at ALL times!

Try https://nitrogensports.com/ or any of the other list of BTC sport sites.  

Hell I will give better odd's on any game that Bitbook.biz offers/parleys and I will let you parley on the same games (Over/under and winner)

Stop being a bitch. BitBook refunded your money after you tried to scam them, and you still bitch at them? Maybe if you didn't act like such a moron, they would've refunded it earlier?

Just a bit offended, I don't find spoofs for free. Then stress all damn day for nothing.

Tried... did you see OP? I had it and could have ran. If anything they are lucky I refunded them


This was his first post to me on page one (after I removed the How-to so they could fix it) So of course I am a bit sore about this whole thing. Then I got pissed off, still am.

They may have lost you, but they gained me. Keep up the good work guys.

How is anyone seeing what bitbook did is right?

Thats pure insanity.

The guy emailed another reputable company with his findings, for this very reason.  Bitbook gets butt hurt because he found a serious flaw, and auto accuses him of scamming and threatens to hold his coins. 

It's pretty cut and dry.  Bitbook fucked up, then they want to punish OP for it.

It is NOT OP's job to help them fix a site bug.  Can bitbook freeze or ban his account?  Sure.  Thats their choice.  Thats fine.  But to keep his coins.  NEVER is that right, ever.  Bitbook can guess at his intent, but I tend to think that since he PM'd all the info to a third party, reputable company, before proceeding, that he was trying to test to see if the site had a clear security leak, or if it would be noticed.

We will never know if the OP wouldd have kept the coins.  But think on this:

If he wanted to keep the coins, wouldnt he have loaded him one account, made all kinds of bets, then transferred them to one other account and cashed out?  What he did makes absolutely no sense for a scammer to do. 

All you people who are saying you respect and are now a customer of bitbook for life after this are insane.  They handled this piss poorly.

OP, glad you got your coins back.  I see what you tried to do.  It's what any person who tests sites for flaws would do.  Obviously these people here have no idea what bug testing is for.  Good on you sir.

Well said Moneymaker.

I think they handled it very poorly.  I'll stick to Nitrogen Sports.

Upon re-reading the thread, bitbook does seem quite sketchy.

Should I paint them red, or...?

I don't think anyone needs to be painted red... they just handled the situation poorly.

They gave him his deposit back and they had the right to freeze his accounts.

They just don't seem to understand that what he did was try to help them, not scam them.

Hmmm, true.

I agree with that, too.

OP could have went about it in a different way, but I don't think he was trying to scam anyone.


Bitbook is wrong for coming on here and saying they were going to give his deposit away to charity. 

It's kind of a silly situation all around, but it's over, this thread can be done with now.

Disagree.  You do it with a large amount, and force them to fix the situation. 

And he contacted someone with the info that he could trust to not exploit it, for this very reason.

Bitbook fucked up, and they want to throw him under the bus.  They don't like that they had a huge risk on their site.  Instead of thanking the guy for showing them the hole, the want to take his BTC?  They should be PAYING that man for not just transferring to another account and inst withdrawing.  Their withdrawls are automated, they NEVER would have seen those coins again had OP done that.

Right!

I don't know the right response, but Bitbook's was definitely wrong.

Hit the nail on the head, thank you.


Thank you for re-reading, if anyone thinks I was wrong please please please take 10 minutes and reread.

I believe Bitbook.biz should pay for having this exposed on their site.  I have seen tons of post of bug's being found and donations being given.

I want to make a pledge.
 

80% of anything donated from Bitbook.biz will be donated to BitCoinTalk.org
5% will be given to my escrow
5% will be given to everyone sends Bitbook.biz a PM urging them to do the right thing (post here count as the same thing)
10% will be kept for myself

All funds can be sent to John K to be distributed.
 :D ::)

Lel.
You made me laugh :)

You are going to get 0. Stop trying seriously. They aren't going to go from "he's a scammer" to giving you BTC. For one they won't do that cause they still think you scammed, 2 that would look very bad for business if they call someone a scammer and next minute they call them a helper.

A: They already look bad for business
B: They already went from keeping my BTC/donating to giving them back.
Edit:
C: No offense, you said you don't want to be involved. So don't be.

I'll toss in my 2 satoshi:

1)  the timestamps of when BayArea contacted ppl/site vs. when he made the freeroll'd bets is the most important information.

2)  as a bitcoin gambler observing the regulation-free btc gaming sites, the only thing we can judge the site on is the record of payouts & decisions.  Remember bestofbitco.in?  Well no one else does anymore either, because the owner was influenced to settle a statement bet incorrectly.  While it's not a similar situation, it is still a test of the site's management, and one of the few data points a prospective gambler can observe.

You will not see a timestamp produced from Bitbook.biz because I escrow-ed my information before the Williams game was even complete.
I have provided the best time stamps I could comparing my PM's/public posts compared to my .1 deposit.

My timestamps (pm and .1BTC blockchain) alone is enough to prove that I was public with the problem BEFORE the account was frozen.

I did however PM the site after the accounts were frozen because I didn't want to bother them if a problem didn't exist.


Bitbook.biz has, at this point, has shown their true colors to the community. It was never my intention on bashing them.
Hell! I was a customer!!!!!!!!!

I am not getting involved like I said HOWEVER you are continuing to beat up an arguement that is over. Both sides have what they started/deserve here and both parties should move on. As far as bitbook is converned imo the thing that matters is if they payout. Talk about 5dimes.eu, they treat customers horribly and their head manager is the biggest prick ever, I spoke to him when they limited me to $50 wagers for winning too much. Now why are they the biggest book in the industry still? Because they pay out, no runarounds.I am up approx 20 BTC off bitbook as high as 30 up at one point. They have always paid me and the withdraws are always instant. Both parties should take this as lesson learned n move on.

Maybe they pay because other people lose. If I would have cleared their account I bet my bottom dollar you wouldn't have gotten shit.

Bottom line:
They slandered me and will not post any Timestamps=Not cool.

King you shouldn't have to brown nose every one in fear they will block you/not pay out ect. (Which is why you wanted to stay out of it)

I swear I will always take your bets/pay out.
Same odd's if not better than Bitbook.biz, you can keep your BTC in your own wallet (no escrow ect.) You PM a bet. If I respond "bet" it is on.  Truthfully that is safer than having BTC with anyone, I will accept bets from anyone with rep like you.

Keep your money until you lose... Isn't that how betting works? I've NEVER given my money to a bookie first and expected to get it back. (Please try me out seriously.)

You made the mistake with posting this here instead of discussing this privately with them after doing this with small amounts.

Mate... I understand your frustration and the need to explain yourself. Sometimes doing the right thing may appear differently to other people.
So grab a coffee and relax...

I read through all of this and I see what you did.... Karma points to you  ;)

As long as you let BitBook know and don't try to start a flamewar on here.

Next time sell it to the highest bidder.

Just make sure BitBook is allowed to bid :)