Black Friday & Cyber Monday Special!

Get up to 470 FREE Spins during 26th November - 30th November!

- Deposit 0.2+ mBTC, get 20 FREE spins
- Deposit 2+ mBTC, get 150 FREE spins
- Deposit 10+ mBTC, get 300 FREE spins

Only new deposits made during the event are eligible, and you can claim each of these separately.

After making a deposit, please contact our support team to add these free spins manually to your account!

Deposit and get a ton of free spins now!

No problem! Your free spins have been added to your account

Have fun!

We've got a few codes for anyone who made over 2mBTC total in deposits!

Use the code NOV100FREE and get 100 free spins, no additional deposit required!

*If you haven't made 2mBTC in total deposits before, and you make these deposits now, you'll then be able to claim the code before 20th November!

Yeah, exploiting casinos it's a pretty dishonest way to live, and sadly it was pretty hard to find this particular exploit, but better late than never, I guess

Good luck with our games! Enjoy and have fun!

Thanks a lot for reading the report, we appreciate it a lot!

Indeed, that's basically what happened, he was able to know the result before finishing the game, so he would bet higher or lower, depending on the outcome.

So this is a warning to all casino owners, as we have reasons to believe that this user (or group of users) has been trying to exploit multiple casinos for some time now (I changed the name of the topic to reflect this, thanks for the suggestion, LoyceV).

Your cashouts were before approved as we were not able to prove & replicate your exploit before, as we have limited team and after a certain time/attempts we always had to wrap it up and give you the benefit of the doubt, even though the numbers of you being "just lucky" were implausible -> but  without proof and finding where exactly the exploit was we always approve cashouts and give users the benefit of the doubt to give a good experience – and it's cost us severely.

We did several checks throughout the months, but were never looking deep enough to find the exploit. But when your numbers kept getting more and more absurd, and on other accounts, we gave it one deeper look and were able to figure out exactly what you were doing with forging requests in specific situations. It is undeniable what you have been doing.

After we fixed the exploit, we also implemented a trap, to additionally verify what exactly you were doing -> and you fell for it. You kept playing Las Vegas Scratch following the same old patterns, only this time your old exploit didn't work anymore, and you stopped after 100ish attempts, and requested a cashout as it didn't work anymore.

And stop trying to push us publicly here – it was an additional reason we were rushing our checks before to try and ensure a good experience -> there's nothing for you to exploit here anymore.

We've sent LoyceV our detailed report to see if he'd be willing to read through it and give his thoughts on our methods and proof.

The exploit was already fixed on our website, and we actually used the fix to also create a "trap" (included in the report), via which we wanted to confirm that the abuser was using the exact same method as we were able to replicate and assumed from all the logs and server requests he was making – as expected the trap once again confirmed this, and as expected after the user found the exploit to be no longer working, he immediately stopped playing and requested a cashout of their remaining balance funds (which we will obviously not approve).

@allyouracid From our understanding md5 is only potentially breakable given enough time to get certain collisions, which was absolutely not the case here. The wins were predicted consistently with basically no delay – essentially it was a code issue on our side, including some user input in some games not being verified correctly, or rather said, in certain very specific situations it caused a potential exploit where user would get unhashes values on next result back, but ONLY if spoofing certain requests with specific data.

Hey, here is a message from my team for you

"Great to hear from you!

You dare asking why you are not getting your withdrawal approved?
How about you tell everyone here how you have found an exploit in several of our games, and have been abusing it for over 6 months now, to steal over 1BTC from us, using several multiaccounts?

Luckily for you we have been understaffed and the exploit was hard to detect so we attributed your wins to good luck after several checks -> because we here always prioritize a good experience for the users, and in this case it backfired heavily on us. But your wins were just abysmal and you had a 100% replicatable exploit and kept being greedy - thank you for that, as it allowed us to dig deeper and find and prove the exploit you were using.

You also know that after we increased the bets, you kept trying to exploit the same games, and it didn't work anymore, and we have logs of all of this.

Thank you for being an awful human being and stealing money from us and likely many others - we have already got in touch with a ton of casinos over here, as we noticed you have had sketchy experiences with several of them, and are alerting them to your fraudulent activity and attempts at exploiting their systems, particularly with pregenerated results."

So if someone is forging requests and actively looking for exploits on our website, in order to gain an unfair advantage which are completely against the ToS of any casinos/business, that is not considered stealing/abusing our site?

We mentioned there's several clear connections between the accounts, including IPs - and even if they weren't connected, each of them was still abusing the exploit in the games.

We honestly didn't look into the connection between the withdrawal addresses as there was no need really -> All of the accounts exploiting used the exact same pattern of registration/playing, email setup, and a shared pool of VPN IPs when playing the games. They also were generally played 1 at a time/day and not interconnect gaming sessions, likely to make it look like different users are playing, and lower our guard portraying it as "he invited other big gamblers" - several of these accounts were also self-referred, to gather additional referral commissions.

How we were able to 100% determine which users were using the exploit, was actually pretty straightforward, when we had a period of no site activity other than 1 of these accounts at a time. We managed to combine server access logs for requests from all of our pool of web servers, which painted a very clear and undeniable image:
- all made from the same IP; and there were no other users playing our games at that time
- the requests were made to one game at a time, in a specific order, which was clearly not how requests should follow one another playing our games regularly.
- the request timestamps clearly matched with database entries of his gameplays

These patterns and crossmatching with our database logs allowed us to find and replicate exploit with 100% accuracy, which we eventually checked all of our games for, and found the exploit to work in a subset of specific games, which were all played on his accounts and exclusively gains of practically all of his profits.

Then there's also clear stats about his gameplays, where with tiny bets he had a <5% win rate, and on his maxed out bets a 50%+ win rate, on games that pay out on around 20-30% of the wins. And with his amount of hundreds/thousands of plays on each of the accounts the odds are practically nil of that being able to happen in the history of the universe. Obviously this is not proof, and was reason why we were approving cashouts despite this for so long -> as without concrete  proof of exploit (and being able to replicate it), we always trust the user, no matter the losses on our end. But it was the reason to invest more time and eventually figure it out.

If there's a trusted user we could send a sample of such proof and methodology to, we'd definitely be happy to!

Hello!

We wanted to warn everyone about a user on this forum. The user is hauzenberg -> profile link: https://bitcointalk.org/index.php?action=profile;u=3122651

This user has found an exploit on our website www.playbitcoingames.com in several of our games, and has been exploiting it with several multiaccounts since February. To date, he has stolen over 1BTC from our website, usually being active once per month, pretending to be a "High roller", so we would be less supicious of his actions and assume he is legit, and just being lucky.

He was essentially betting huge on our bets, and appearing to be very lucky in several of our games. We had several investigations at various points, but were not able to prove any exploit being used, and just kept attributing his unbelivable winning streak to good luck. In the beggining this still made sense as up to a few thousand plays it still felt potentially legit, but as it kept happening month to month, it became increasingly clear something is off.

But as we have been understaffed and were not able to look really in-depth in this, and as we tried to maintain a good reptuation, we kept approving his cashouts -> he also clearly made an account here only to pressure us publicly into approving his wins, and unfortunately it kind of worked.

Just over a week ago, we looked into it again, and digging through server logs, and looking for patterns, noticed there was something weird -> essentially it seemed as he was able to predict with basically 100% accuracy his big bets on big wins (but he faked it down to 50%, to not appear as crazy, to what should've been 10-30% chances) – we looked as far down as our http/apache logs to look at server requests, and found he was indeed spoofing & creating various bets with invalid data and in specific orders, to find exploits in some of our game's md5/pregenerated results system.

As we noticed some suspicious activity reading his activity on this forum on other casinos, we wanted to alert all of you of this user, and if he is also "seeming lucky" on your casino, to investigate him THOROUGHLY.

Here is all the information we have on this user:
- he uses VPNs, but is usually sloppy/lazy and mostly uses German VPNs
- his emails are in 99% cases disposable ones @protonmail.com, so we'd suggest to be vary and check any users using those emails as well.
- here are several emails we confirmed to use the same exploits (which are him or even his friends): stewartod@protonmail.com, hauzenberg@protonmail.com, trx.whale.lol@protonmail.com, trx.whale.lol+gambling@protonmail.com, cad0104@tutanota.com, jozefno@mailfence.com, waivent@protonmail.com, shemsi37@protonmail.com
- there's likely a ton of others he used to abuse our free offers/free spins, but that's not as such a big issue to us, and "impossible to prove"
- Here is a list of several of his Ips, confirmed to be exploiting: 185.210.217.132, 152.89.163.172, 178.239.198.228, 178.239.198.30, 136.144.17.12, 193.37.255.216, 45.123.117.25, 31.171.152.37, 178.239.198.196
- here are some of his bitcoin withdrawal addresses he used: 1ESZGM1kXuk8TXZQzcXdaZsSXFYeHUNBh8, 1CmM4YH5yx9H6aN1Bi63ptJo5crMrKwrxX, 168v8C5TdYR6MyfHGC4HMLWXJxNXeKBBC4,193uKVVxE2eu3eWdgHsJxskoJkrvNpQSQo, LZgiWgeEw6VdqNYnr9DZe1VS4xBwaG5awU,15UPnMwhmAqdLsdFeGVMKVLN7dVVPUKPnE , 15KxaAfdDLDmYPWPCviGF6Yzi47RZoJKM2, 1Mk8osiWVHfdWmpbeYYYsiC3rSNGfdUWmA

I can't share exact details of what he did in our site, but essentially he found a way to send additional and/or requests with adjusted data, to trigger some cases where he was able to get unhashed result for the next play before the next play or before play ended, and adjust/increase his bet. It was caused by some coding inconsistencies in some of our games.

We hope any of this information helps, as we are 100% confident he has tried abusing other casinos as well – and very likely successfully, as otherwise he wouldn't keep doing this.

Kind regards.

Hey there!

We'd like to let you know that we've again listened to your feedback, and have raised maximum bets on basic Slots & All Scratch Games!

Have fun, and keep an eye out for more free spins sent out in the next few weeks!

No problem!


Thanks for the feedback! Hopefully it can be implemented in the future


Hey! We adjusted our bets first and foremost to address most of our players for whom the bigger bets were unreachable. With the increase in BTC price we also are evaluating our risk with allowing bigger bets, as well as that adding more higher bets requires some UI work and further testing, and we wanted to get these changes out as soon as possible. We will consider adding more higher bet options in some of these games in the next few weeks!

We've got new exciting updates for you!

1) Minimum cashout lowered to only 0.2mBTC!

To make it more approachble for you to use, taking into account the rise in BTC value over the past year, we've lowered the minimum cashout to 0.2 mBTC!
We would ideally like to lower this further, but that will require some more core changes in our system to avoid us paying massive bitcoin transaction fees, but hopefully in the near future we can bring you that as well

2) Lowered minimum bets part 2.
To continue what our previous update has started, we've now lowered another 10 games' minimum bets by about x10!
This is part of updates that also takes the increase in BTC price value into account, and allows you to play our games with much smaller bets!

The games that now also have minimum bets lowered are:
Crime Night
Gold Digger
Jacks or Better
Keno
Las Vegas Scratch
Paper Town Flip
Pirate Scratch
Sailor Scratch
Multistrike Poker
Prize Spinner

There's now only a couple of games left we have to reduce the bets on, but due to their nature they requrie some more work and art changes, which will take us a bit longer to prepare. But we didn't want to delay these changes further on the games we were able to update quite easily