Since everyone loves charts as much as me, here's bustabit's historical wagered/profit chart:

Congratulations to LosDeXibalbaMC for (briefly) hitting the +100 BTC net profit club!

If you're interested, I sell copies of bustabit.com source code for 2 bitcoin. It comes with 100% of the source I use to make it, and has been adapted for csgo sites (e.g. csgocrash.com a bunch of times), who I believe made well over a million dollars with my code =D

It's written in node.js and postgres. The only condition is you don't further redistribute it.

You already asked for an easy way to prove your bankroll which I provided:

Cool, it's good to hear you guys take this stuff seriously. Although, it's generally regarded as a security issue itself to have an open redirector like that. For instance, I can create the URL:

https://bitfortune.io/noreferer/?url=https://bitfortunemalicioussite.com


(of course, obscuring it a little)  which makes for a great phishing URL amongst other things. Instead setting a referrer policy of "same-origin" is probably a much more robust way of stopping leaking referrers headers. It has the added benefit if you add more links or external resources in the future, you don't need to worry about accidentally leaking



Also another thing is that your popups and stuff actually clear the #hashfragment part, which is where you include the warning about not sharing the URL. i.e. if someone plays a game, or goes to their account settings, the secret is still in the URL but the warning is not. It'd probably be better if you appended, rather than replacing it

BTW, this is a horrible idea from a security perspective. Not only do people leak their secrets accidentally via screenshots and what not, it also leaks via the referer header to all external things. (e.g. I just tested and the referer header gets sent to netnanny when you click that link). You could look into https://www.w3.org/TR/referrer-policy/ to avoid that leak, but if you're going to use storing secrets in a URL, you're better off doing it like this

bitfortune.io/#1772a033c8f06b4690320df2394a46ff8593a6380dc1eb065d#DO_NOT_SHARE_THIS_URL_OR_YOUR_ACCOUNT_WILL_BE_HACKED


As things after the hash are never sent to any servers, but can be read client side (and then sent to the server for validation)

They're also crazy unreliable at showing incoming money, often not showing unconfirmed funds until they actually confirm. Also showing confirmed funds as unconfirmed and a bunch of other stuff.

I literally get more support requests that are to do with blockchain.info's crappy wallet than my own casino. I'm at the point where I'm on the verge of putting a warning on the deposit and withdrawal page to not use blockchain.info

Yeah, it's just a stupid parking page. But dicesites.com on the other hand is pretty cool

That 450k bits represents the max profit you can win per game, not the bankroll. For safe bankroll management, I'd expect that the OPs bankroll is about >= 100x larger than that.

Nice work, glad to see all your hard work come to fruition 


Good luck with your project!

Big congrats to coolblown for being the latest member of the  +100 BTC profit club

All queued withdrawals will be mixed with other withdrawals, so it might help a little. But in v2 there's going to be a *lot* of additional hot wallet privacy, mainly due to pushing users into using new deposit addresses each deposit (but allowing use of old ones) and making it very difficult/impossible to cluster our hot wallet by following change outputs.

And there's a few other tricks I'm doing for user privacy, but I'll avoid revealing them here



In the stats are included the amount users pay, but it doesn't take into consideration what the actual mining fee was. So in reality the site has made a bit less money than the profit would otherwise suggest

On a light note:


This sounds like the Multi-armed bandit problem (which literally is: how to find the best slot machine by playing them)

with the fun snippet:

I mean, I have a wallet on my phone with 50 BTC in it, not the phone itself is worth 50 BTC.

Bustabit currently has instant withdrawals for 0.0003 BTC (300 bits) and we use quite generous fees to make sure your withdrawals don't get stuck, like is happening at a lot of other sites.

This is already pretty reasonable (it's actually a money loss for us), but in the next update: it's going to be even cheaper! Well, there will be the option to have your withdrawal cheaper if you don't need the money right away. The way we can offer that is by putting your withdrawal into a queue, and tack it onto the next (instant) withdrawal.


Both "pre-credited deposits", and "queued withdrawals" are just going to optional enhancements. For people who want to wait for 1 confirmation, or people who want instant withdrawals -- they won't be disadvantaged at all.

It's a pain in the ass. But to do so, you'll need to give us the the redeem script (which we can use to generate the address, and figure out the required public keys). Or if you've already sent funds from it before, you could just give us the address and we grab it from a block explorer. And you'd need to sign a message from 3 of the 4 public keys required by the redeem script.

A far easier way would be to send the min amount of dust to 14sMJzh8wB1MLbnuN2LvPUsfakomVY5h4c (a random address I just generated) and if we see the source of it was an address with 50,000 bitcoin we'll know you control it =)


Or an alternate way, would be generate a new multisig address, preannounce it here and then move all your funds there. That should be enough to confirm you have the funds

You need to log the actual error, probably a setting in PHP so you see what the 'internal error' is, not just that one exists. From there it'll make it a lot easier to find what's going wrong.

I strongly think the best wallets for normal users are mobile wallets, I've had good experience with mycelium (android) and breadwallet (ios) and can recommend both. Most people seem to not like the idea of mobile wallets as they're worried about losing their phone, but making a recovery key that's not an issue.

For instance, on my (non-rooted) mobile I regularly have 50+ bitcoin and have installed a huge amount of random apps. That's something I'd never even dream of doing on a desktop for instance.

For sums larger than that, it's probably worth investing ($100) in a hardware wallet (I use a trezor, and am quite happy with it).

Yeah, what DarkStar_ said.

Also the other issue, is that blockchain.info is super unreliable at showing new transactions. Bustabit makes all withdrawals instantly, and a few percent of the time they don't appear on blockchain.info (but are on all other block explorers) despite being perfectly normal transactions with high fees. People then freak out thinking that either that I've made a fake withdrawal, or something has gone wrong with bustabit etc.

In reality the issue always resolves itself (typically as soon as the transaction gets 1 confirmation) but I get pretty sick of ~50% of all bustabit support tickets being related to blockchain.info problems, so I use every opportunity I can to talk people into using other wallets

On a related note, I've also been working on a cool "deposit booster" for everyone who has bitcoin deposits stuck. I typically get like ~10+ support requests a day about people who are in that situation (please folks: stop using blockchain.info's wallet).

I haven't hooked it up yet, but I have a rough proof of concept working. For the technical it simply creates a transaction that spends from your (unconfirmed) deposit to a new bitcoin address (i.e. 1 input and 1 output) and because it pays transaction fees, it'll boost the priority for deposit itself. There will be no (extra) fee for such service, you just pay for the bitcoin mining fee of the deposit boost. Based on my testing it seems like ~30% of bitcoin hash power supports this (CPFP) so it's not amazingly good, but it'll be useful in the stuck case.

The really cool thing about it, is there's no risk for me (since i'm spending from that specific deposit).


Now I also need to figure out how to explain this to users, as there will be "boost deposit" and "precredit deposit" lol ><