I don't remember how I funded the wallet, but it's pretty unlikely. I try to aggressive purge any data I don't need, as in my position its far more of liability than an asset.


Anyway, I think it's pretty clear that greenaddress knows that it's my money. If I wasn't the real owner, and the real owner (even if he had 2FA access) would be totally screwed. The wallet is (or at least: was) blacklisted, and customer support ignores all the people trying to claim the wallet (I know, thanks to all the people I've encouraged to try claim it).

If greenaddress had the slightest doubt, they would remove the blacklist and replace it with "Please enter 3 consecutive codes" to unlock the money (that way it couldn't be brute-forced, yet the real owner could still claim it).

  
So no matter how you view it, greenaddress is screwing the real owner of the wallet 
  

Note the domain they're using is bustabita.com not bustabit.com Would be a good idea to report that app to google, report the domain here:
https://www.mydomainprovider.com/contact_abuse/
and https://safebrowsing.google.com/safebrowsing/report_phish/?hl=en

I guess so. This was announced after I created a bit of drama by releasing my mnemonic publicly and encouraging people to annoy them. I assume they added this clause for me:


however they have never actually returned my money, even when I'm willing to offer x10 the amount of money in question as a surety bond. I'd even settle for a timelocked transaction from that output that pays me in a couple years or something. And my offer I made to Adam Back to donate the money to charity still stands.

It's not as easy as you think.

As an example look at this transaction:

https://blockstream.info/tx/a697ea66639ba7966269e935d4374e28bc368ca683c7214dfc28e42eae026dde


blockstream has a pretty basic privacy analysis:
* Round payment amount
* Mixed script types
* Unnecessary input heuristic

which suggests the privacy of this transaction is quite poor. However, it could actually be excellent! I have frequently hand-created transactions that look like they are doing something obvious (e.g. this transaction looks like it's a payment to the 0.3 BTC output) but in fact, that 0.3 BTC output might be the change output! (thanks to careful coin selection/mining fee)  and maybe the 0.021026 BTC output is actually the payment. The absolute best transactions from a privacy point of view look like one thing, but are doing the other.


So to create a real "privacy score" you basically need to know "what it looks like" vs "what it actually is" on a wallet level (?)

--

Another good example is: https://en.bitcoin.it/wiki/PayJoin  it looks like a normal transaction, but is actually a special type of coinjoin. It's kind of like kryptonite to chain analysis, because they make the wrong assumptions but have no idea where. I did one, and watched chainalysis (i think best in the business), create wrong assumptions about literally thousands of transactions, all because of a single payjoin

lol yeah, that was fun and just me being a dick. I figured since they had blacklisted my wallet, giving out the mnemonic on reddit would be a PITA for them. It'd be hard for them to justify blacklisting my wallet to people trying to social-engineer them, and I figured it'd force them to waste time developing a more advanced solution than a blacklist (e.g. like what Amazon does, and requires you to enter two 2fa codes in a row) so it's no longer brute forcable

Sorry for the overly sensationalist title, but it's basically true.

The sequence of events are:

a) I created a green address wallet (Oct 2014), and backed up the pin and mnemoic

b) GreenAddress mandated the use of 2FA, where one of the options was 2fa with google authenticator. I used this.  Please note that in Oct 2014 the green-address 2fa system was quite different to how it is now, and effectively a design flaw they have since identified and fixed.

c) I sent 0.1 BTC to my wallet (txid 953152310ec8ca69b4582d5e3fc859bcf8823514fb66e8aad68ddba85512185a )

d) Google authenticator offers no option of exporting data

e) I lost access to my phone and thus my 2fa and by 15 Oct 2016 had been in contact with greenaddress about it

f)  Later communication with green told me they have never reset a 2fa

g) With no other options, I took maters into my own hands and wrote a bot that very gently tried to brute force the 2fa code (e.g. something like every 5 minutes) as each 2fa guess has something like 1 in a million of being correct by accident

h) greenaddress decided to blacklist my wallet because of my constant guessing. This meant even with the correct 2fa code, my funds would be inaccessible

i) Sept 15 2017, greenaddress still refused to help me and my wallet had been blacklisted. Out of frustration I released my private mnemonic: "girl wheat quantum ski myself enter buyer dress police they unfair tape timber summer either jump fuel woman stage pet acoustic tool flame magnet"   (although I never released my pin, just incase I needed to prove I was the original owner).

j) Because I publicly released the mnemonic, I put greenaddress in the position where they have custodial control of my blacklisted funds (they are the sole party who knows 2-of-2 keys) and out of spite, hopefully have to waste a lot of time with social-engineering


k) In private, I talked with Adam Back that I would be happy to agree to donate my funds to a list of charities and relinquish my claim to the fund. He agreed in principle that it seemed like a reasonable resolution, but then I never heard back.


l)  It is now late 2020, and greenaddress is still sitting on my funds. I fully admit my rash decisions (brute forcing, releasing privatekey) were silly and spiteful and had I not done it, I probably would have been given access to my funds by now. But  I do not see why they shouldn't simply send it back to me at this point, I can't imagine it'd take more than 5 minutes and I've offered them a 1 BTC surety deposit that no one can make a competing claim (e.g. has the totp secret and pin).

Pretty convincing logic right there. The only reason Devans who is not normally very active on these forums hasn't been online for 3 days is because he's spent the time posting a few posts as Justin. And the only reason someone would take precautions like google-authenticator for their accounts after being harassed (and no-doubt attempted social engineered) for years is, naturally, because they must be Daniel.

@Justin_m I think it's one of those things where the more you engage it, the more interesting you make it. It's almost like pizzagate, the more you say "we don't run a child-sex traffic ring in our pizza shop" the more it sounds like you do.  If I were you, I'd avoid interacting with these people as much as possible and wait until they find more stimulating uses of their time, like playing in traffic.

FWIW it's not a question of mistaken identity, or two people with the same name. It's just some random theory someone made years ago, and the more it's denied the more it's stuck. Luckily for you -- only an idiot would believe you are Daniel -- as you are an American living in America. I very much doubt bustabit would've been issued a gaming license if the owner was in America, but even if they did, it's be astronomically stupid to live in America as a casino owner as I don't believe there's any real way to do so legally.


 The post you're referencing is me quoting someone who says your name, so I've edited it to not contain your name ... but i'm not sure what difference it'll make.


Edit: One idea, not sure if you want to go this far. Is make a police report about the threats and in the police report explicitly deny all connections to bustabit. It's a crime to lie to the police, so it'd obviously be something that Daniel wouldn't or couldn't do. You can then send people a scanned copy of the report to show people this (and the fact that you are reporting people who make threats).


P.S. If it's any consolation, I've received enough threats that I am almost offended by the lack of them now (if no one wants you dead, are you doing something important?) after selling bustabit. I've never been ultra-secretive and done things like meet players in real life and a few people have my address etc, and I'm still alive. At least on a logical level know that people who make threats are bored internet kids who haven't been outside in the last 10 months.

Hi Justin,
I'm Ryan, the previous owner of bustabit. This is now a couple years ago, so my memory might be a bit off. When I sold bustabit to Daniel, someone confidently announced that Daniel is "Justin Malara". As far as I know it was just a random guess based on who knows what. Me (or Daniel) probably went with something like the standard "no comment" type response, and people have taken it as a sign it must be correct. And the more it's denied or rebutted, the more (crazy) people think that it "must be true" and that's why it's being denied.

Unfortunately I suspect your denial is just going to reignite the stupidity. There's probably some stuff you could do, like livestream yourself chatting to Daniel, but people will just go conspiracy and think it's Daniel covering his tracks.  I'm not sure the best solution, but I suspect it is just laying low and not rewarding people with interaction.

I've had some pretty nuts conversations with people, like someone saying: "Give me X bitcoin or I'm going to kill you. I know you're address, it's Y" and the address Y is wildly wrong. I'm like "Dude, I'm not giving you money and I promise you that address is wrong so please just leave them alone" and they take that as a sign they must be on to something ><

Forwarding threats to the police is probably a good idea, but I wouldn't expect much to come out of it either. :/

I don't think that's the complaint. At least my problem with most casino review/comparison sites is they pretend to be a list of "the best casinos for you to play at" but are in reality are a list of "these casinos make us the most money". Often those two lists are wildly divergent, to the point some of the biggest casino review sites literally knowingly promote some of the most worst casinos out there.

Yeah, your site was actually one I had in mind of thinking of exceptions. It just is unfortunately pretty small compared to some of the competitors, although I think if you expanded more with content (reviews?) (and community?) there would be some serious potential. There was one site (thebitcoinstrip.com) that I thought had so much potential and was going the right way, but then as I understood, sold to someone who just destroyed it

I can only speak for bustadice, which does indeed use 2-of-3 multisig wallet, of which I hold one of those 3 keys.  I can independently verify bustadice's player profit/loss (and thus investor profit/loss). So I use that to guide if I should sign a transaction. Although worth emphasizing that  independently verifying player profit/loss is not really enough information to do a great job at being a cold-wallet-key-holder because I have no way to independently verify the bankroll size. (i.e. If Daniel was malicious, he could simply say "Oh we've had a mass exodus of investors. Need you to sign the withdrawal so I have enough funds to pay them" and I'd have no way to know either way).

I have a special role for bustadice (I run the audit server, and hold one of the keys). But don't provide a similar service for bustabit. I could however take a pretty good guess at what Daniel is doing for cold storage there, but it's not really my place to do so.

That makes sense, although I think I can make a decent counter-argument. By giving people dilution fee credits, you are giving them something worth something but it'd be very tricksy to sell. As they would basically have to sell their entire busta* account to someone who wanted to invest. At first I thought it'd be neat if you allowed people to safely trade their dilution fee credit for bitcoin with prospective investors, but that seems overly complicated when you yourself could just give everyone cold-hard BTC instead and recollect it on the next X of new investments. So in effect, it would be like everyone immediately and safely selling their dilution fee credits, and you're just fronting the money until enough new investments come in.

Then again, it is a bit of a weak argument as you logically extended it basically means the dilution fee shouldn't exist (as someone's should be able to sell their investment, rather than divest). But thought I'd throw that out there anyway 


My experience with virtually all casino-review sites (there are however a couple small exceptions) has been the only thing they care about and optimize for is their own bottom line, which generally means pushing what gives them the most affiliate returns. The casinos that give the most affiliate returns often are the worst (i.e. that's why they need to spend so much on affiliate, and they do dodgy stuff to have high margins). Ever wonder why sites like askgamblers will knowingly list and excuse outright scammy behavior like bitstarz as #1 (even defend WTF-bad practices, like seizing account balances for accidentally exceeding a software unenforced and unwarned betting limit )?

It's a pretty rotten industry really. I've been waiting for someone honest to disrupt it, but doesn't seem to be happening any time soon.




I have never been doing that for bustabit. I do that for bustadice, as I run the audit server -- so it makes sense in that context -- as running the audit server allows me to verify wins/loses due to bustadice's multi-party provably fair scheme (there's basically 2 server seeds, and the audit server has one which Daniel himself doesn't know).

FWIW, I haven't been involved in the site in an official capacity for like 2.5 years now =) I just stick around as I'm a bankroll investor, but invest on the same terms as everyone else. Actually back when I ran the site, I 100% privately bankrolled it. The public bankroll thingy is Daniel's game.

I think Daniel obviously now has an oversupply of capital, so it makes sense for him to squeeze investors by paying them less. As an investor, I don't really mind at all as I'd do the same (e.g. if volumes slowed down, I'd divest...).

I also think you're right about the offsite thing, but also think Daniel is right to not want two classes of investors as it's rather unfair. You also obviously didn't exploit the offsite system, but also didn't use it for its intended purpose.  

I'm not sure if it's a good idea, but one idea for Daniel: Instead of giving people "dilution fee credits", give them actual bitcoin. Then if they want to invest more, they can use that to cover the expense. Or if they no longer want to, they can withdraw that money. And then say you gave way X bitcoin, configure the site to direct the next X bitcoin of dilution fees to yourself instead of the bankroll.

I'll +1 Timetwister's suggestion of capping at 100% just as it avoids the question of "what would happen if the bankroll exceeded 10k btc. So:


Just for the sake of terminology, lets call the 10k bitcoins, the "bankroll cap". I kind of wonder if having a static value like that is ideal, considering how stupidly volatile btc price is (and that people tend to bet more pegged to fiat value than bitcoin value).

I imagine a "bankroll cap" of something like:


and refreshing $US_DOLLAR_INDEX  and $BITCOIN_PRICE_IN_USD every day or so might make a bit more sense?

Oh yeah, that was funny. Dean raged against people "abusing" the wagering contest by adjusting their wagering in response to the competition. And Dean didn't just cancel the promotion, he literally rolled back all bets. The guy is a certifiable nut job   

It is literally the opposite. The higher the bankroll, the higher the commission. To the point 10k BTC bankroll would mean 100% commission. So basically the size of the bankroll is capped.



Hm? On the one hand you're supposedly concerned about users' privacy ("honeypot", no Monero or whatever) but at the same time also criticizing that bustabit doesn't collect enough personal information. Most of your questions kind of have pretty common-sense answers though:

* Geoblocks are extremely ineffective, the average crypto user has a VPN and can switch countries in 30 seconds. It makes more sense to simply ask the person, as if a user wants to get around your restriction they will do it anyway. And the US is pretty much the most common VPN endpoint due to no-mandatory-logging laws and proximity to most online services.

* You say deposits are fully traceable and  zero due diligence is done, which either makes no sense or you know something we don't

* Of course many players break even. Many lose money too. Many make money. That's kinda how a casino works. Your example is of someone of someone breaking even is someone who made 104  BTC. 

* Obviously bustabit has way more volume than sites like rocketpot.io. I can think of several factors that virtually guarantee it. bustabit is the original, they're a clone. The tripled bustabit's house edge, so that by itself would lead the average gambler to run out of money 3x as fast (and thus wager less, and  have as much fun and less likely to come back). And the entire site makes a bunch of nonsense claims like their clone (literally using the same code) is an "exclusive game" and bullshit like "and the house gains confidence that all wins are legitimate"  which I believe is just plagiarized from bustadice's multi-party system and has absolutely zero applicability to them. So no surprise they do shit volume



Currently there's a grandfathered in offsite system, it's been deprecated for a long time (still exists, but no new users can use it. Old investors can only decrease their offsite). That is fully going away, which will create a more level playing ground for all investors. Currently bustabit charges 50% commissions on profit, but Daniel is changing it to "bankroll/10000btc". So on day 1 it will be marginally less commission, but as the bankroll grows the commissions will keep going up and up and up, and virtually guarantees that bankroll will never go above 10k btc. As the bankroll goes up, returns for investors will go down, which will cause investors (at least like me) to divest. So it'll reach some equilibrium somewhere between 5k and 10k btc I imagine. (i.e. commissions between 50% and 100%). As an investor, I think of it as bad news. But I can also see why Daniel doesn't want to pay investors more than he needs to do.

Hm, I didn't try to be unfair. I just picked a reasonable sounding timeframe. I just tried a few others:

30d investor profit = 393.06 BTC = 13.10 BTC/day
90d investor profit = 533.50 BTC =  5.93 BTC/day
180d investor profit = 770.41 BTC = 4.28 BTC/day
365d investor profit = 1,992.74 BTC = 5.46 BTC/day


Even just round down to 4 BTC/day. It really doesn't change my point at all.

On a serious note, why do you guys think Dean is even bothering? I have trouble believing that he's delusional enough to think he can scam another round of investors/players. His site was completely and utterly dead after all the scammy shit he pulled (and then before the final "oops, hacked").

My guess is just that he misses the attention? Or perhaps because his name is now so strongly associated with being a scammer, he's hoping if he creates enough noise it'll be unclear to the casual observer if he's actually a scammer or just a misfortunate businessman?

 If you were using the offsite system as it was designed, you can easily just bring those funds onsite for free (with the dilution fee credits).

I think the running theme of your post is that early investors should have some sort of advantage over new investors. I get where you're coming from, and I say this as someone who literally invested in the bankroll on day #1 -- that I don't think that's fair. Earlier investors have already been rewarded by with crazy returns. When they did invest there was probably a lot more risk, and there definitely was a hugely higher expected returns. I have a solid stake in the bankroll, and have quite literally withdrawn way more than I've ever put in.  I guess I see it like bitcoin, it doesn't seem reasonable for early adopters to get some extra benefit/treatment for investing in the projects infancy. The reward is literally that it's worth so much more now.



Even if you did the more extreme version ( stop all new investments) the bankroll would continue to increase by the investor profit (minus divestments). Investor profit over the last 90 days has been 533.50 BTC, which is an insane amount. That's literally like $100k/day average. I assume Daniel is in the position where the bankroll has become so big, that the only thing that happens by it increasing is increasing his liability.


But if you think of it though, it's actually a pretty clever idea. I think it'll become the standard way of doing bankroll commissions in the future. Basically Daniel is running a sort of auction, where investors are basically bidding against each other to provide the bankroll bustabit needs. (Although for the record, I don't think a linear relationship is the most optimal way to model it, and I would've pegged it against USD or something a bit more elegant than a fixed number like the largest bet in the last 3 months)