My opinion:

I'm looking at unibtc.4real signature address 1Uni1bGoEeDfdW2skwv2JihHrnrJe5RQf

All sent transactions here
https://blockchain.info/address/1Uni1bGoEeDfdW2skwv2JihHrnrJe5RQf?offset=0&filter=1
Mostly are .0002 fee, sometimes .0004 fee when many inputs.  So perhaps an older version of electrum which uses a .0002 btc/1kb default fee.

It is very inconsistent and shady to have such a low fee 0.000001 when you never customized your fee before.

Interesting that you prepared a defense for this already when nothing was mentioned about about location.



This is inconsistent on how you felt before:




Agree with dooglus here, no legitimate honest customer would be fine in parting ways if they were indeed scammed. Only a double spender would be happy to get back the deposit.

In reading through the thread, this comment struck me as unfair:


This isn't true. Fees are only required if the priority of the transaction is too low. You can figure around 1 "BTC day" of input weight as the threshold.

unibtc.4real's deposit has 3 inputs worth around 18 BTC in total, each about 4 hours old. That gives a weight of around 3 BTC days which should be plenty to qualify as a fee-free transaction.

While it seems strange that unibtc.4real is using the exact same fee as the attacker, it strikes me that they both may have just used something like the "frugal fee" box on blockchain.info's wallet webapp. It has been a long time since I used it, but from what I remember it has predefined fee settings. If the fee both these guys used corresponds to a preset in a popular wallet app then this looks much less suspicious.

The main thing that raised my suspicions wasn't any of the points you made, but this:


If I was falsely accused of cheating, there's no way I would propose settling for just my deposit back. "I risked my coins and won, dammit! Pay up!" would be my attitude.

I don't envy you the position you find yourselves in now. You don't want to let the scammer get away with it, but you also don't want to punish an innocent player. I guess the solution here is to either stop accepting zero-conf deposits or at least restrict the range of deposits you credit instantly. Maybe insist on a certain fee, only offer instant deposits up to a certain size, limit it to accounts with a certain betting volume, etc.

I will try my best to show what we know regarding Unibtc4real's account.

First things first, cheating is absolutely not allowed on this site. If you get caught cheating, you lose your account and all coins. We are very clear about that in the terms of service. We never cheat our users, and expect the same in return.

Below is an example of a recent double spend on BVC:

https://archive.is/hR49i

The 2.1 BTC was sent to 16nuq6EU9wRgpXK9BLN1iz5hEWb2Xg966o which is a deposit address on our site. The transaction has a very miners low fee of only 0.000001  BTC, which means that it will generally take a long time for the transaction to get confirmed.

However, this is the transaction that actually got confirmed:

https://archive.is/T1lGY

This new transaction has a higher miner's fee, and because it made it into the blockchain, it invalidates the first transaction.

This means that the user was able to credit his account on our site, play the games on our site, and then invalidate the transaction as though it never happened.

The reason why the user decided to try to invalidate the first transaction is that he played a single 2.1 BTC game of Dice and then lost. He can then revert the transaction and get his coins back. If he were to win in that game of Dice, he just lets the original transaction continue until it confirms and eventually he can withdraw his winnings.

In the past few days we were able to find quite a few double spend attempts with similar deposits, mostly coming from a handful of addresses. We were able to stop most of the attacks by making it impossible for the user to withdraw his winnings.

A lot of the double spend attacks were coming from this particular address:

https://archive.is/5bTKf

If you follow through some of the transactions you can see that blockchain.info is declaring them to be double spends.

So, we know without a doubt that some accounts were used for double spends. We can then compare these invalid accounts with the account that unibtc4real claims is legitimate, to see what similarities there are. If there are enough similarities, it should then be possible to associate this account with all of the other illegitimate ones, and declare this to be an attempted double spend.

I will list those similarities now:

=======

The double spend accounts all used a tiny 0.000001 BTC miner's fee. Unibtc4real's account also used a 0.000001 BTC fee.

The double spend accounts were created around the same time as Unibtc4real's account.

The double spend accounts played Dice, betting the full balance in giant bets. The double spend accounts would bet 10+ BTC in single bets. Unibtc4real's account also played dice for enormous bets. His account has giant bets for 11, 12, 13+ BTC. It is rare (and risky!) for our users to make such giant bets on our site. The reason for doing this in a double spend attack is to quickly win or lose the coins so that you have enough time to undo the transaction if you lose.

The double spend accounts mostly played Dice with about an 80% chance of winning. Unibtc4real's account also played Dice at the 80% win setting.

The double spend accounts sent me emails as two different people saying that their funds were locked. However, I was able to see that they are the same person, since both of those double spend accounts were funded by 18zRryZwo7KefNGiFM5SLBsMVZA4TPwaLd . So the double spend user has no problem sending emails pretending to be someone else. Unibtc4real also sent me emails saying that his funds were locked, but he accidentally used two different email accounts with two different names, despite the conversation continuing as though he were the same person. So the double spend users and Unibtc4real both switch between different aliases.

The double spend emails were sent at 7:56 and 8:27 am (EST). Unibtc4real sent his emails at 7:46, 8:02, and 8:51. So if you sort the timing of the emails, you get 7:46, 7:56, 8:02, 8:27, 8:51. These times are all very close to each other, and could imply that it is the same person writing all emails within the same timespan.

=======

Each single piece of evidence is not strong enough to claim that Unibtc4real's account is associated with with the double spenders (the accounts that we 100% KNOW were double spending). But taken together, all of these similarities lead us to believe that Unibtc4real's account is controlled by the same person that controlled the double spend accounts.

So that's what we know. Any feedback would be great!

Unibtc4real also sent me emails saying that his funds were locked, but he accidentally used two different email accounts with two different names, despite the conversation continuing as though he were the same person.

Hi,

We are working on resolving this issue. If your account is in good standing then you will of course get your coins back. Unfortunately, there is too much evidence right now which leads us to believe that this account may have been used in a double spend attack.

We are not happy about this either. We just want everyone to have a good time on the site, but issues like this make it difficult. We always worry about users trying to cheat the website, which is a bit of a bummer.

Bitcoin Video Casino has been around for 2+ years and has never tried to cheat its users in any way. It would be ridiculous to throw all that away for 14 BTC. If you did nothing wrong then you have nothing to worry about and you will get your coins back.

In the last few days we have had problems with users double spending Bitcoins in order to try to cheat the site. This particular account shows very strong evidence of being a part of the double spend attacks.

We are now looking into the problem.

The unfortunate truth is that in the future we may have to require confirmations for all deposits in order to prevent the selfish actions of a few bad people, which really makes us quite sad.

That's correct. The jackpots that are shown in the list are based on the absolute size of the prize paid out. This unfortunately means that the big wins list now mostly just shows the huge 0.2 BTC Slots jackpots... :/

So far it has happened quite rarely that users forget their passwords. In these cases I usually get in touch with them by email to sort things out and give them a little bonus. I think most users have enjoyed this experience. As it's a surprising amount of work to operate a bitcoin casino I admit that I have been cutting some corners here and there :-)

But I do agree that we should have this by now. Will add such a system as soon as I get the more urgent issues out of the way.



LiQuidx is exactly right. I've added a "How it works" section below the game, but I guess it's still a bit hard to parse. Here are two excerpts that might help you understand what is going on:

"Essentially, Chart Bet is really similar to a dice game on auto roll (actually, it's more like playing three dice games at the same time, one for each chart). When you buy a stock, it's like you turn on auto roll for that dice game."

... on how the change is computed:

"We compute two numbers, a positive number which determines how much the chart changes, and a second number that determined whether the change will be upwards or downwards. We apply the house edge to the second number, this means that the change for a downward change is 0.2% higher than for an upwards change."

Hey boopy265420, awesome, added you to the list. Beta testing has not started yet, but will let you know when we start...

Bump