Great to see you guys finally on here.. to say I'm a fan of this service is a massive understatement.. lol

https://youtu.be/mljNJCe14hQ

Currently chatting with Admin on Discord and resolving the issue(s). Great responsiveness and eagerness to resolve the bugs I have submitted, looking forward to working further with admin team, so far so good.

Definitely a big plus for this exchange and its trust factor. 

Hi, do you have a paid bug bounty program? I have a ridiculously serious vulnerability to report. Where do I go for the fastest possible contact with the admins.

Open doors, not quite, it's just incompetent retards putting next to no effort into their website as it is a scam from the beginning, so why bother having a secure website when you don't plan on being around long enough to give a shit?

They made roughly $317,000~ USD from this scam ICO (if the $1=1AFCASH) is the same price at the ICO as it is now (from what I can see on the backend).

Look at this shit lol







That's the developer ^

Feel free to check out the reviews from our many happy customers  

https://www.reviews.io/company-reviews/store/xcoins-com1

Please. Do NOT do that.




And I put money on the fact it was a planned exit scam from the beginning. The developers password for admin panel was 123456.

Cryptocurrency Exchange /ICO Website Penetration Testing Services


We Deliver Professional and Top of the line penetration (hacking) services for your cryptocurrency exchange/website/business.

We assure you that our pen-testing services are of the highest quality and immensely thorough so that you can have as much peace of mind for your customers security and data. We have helped 50+ cryptocurrency exchanges, business owners & other cryptocurrency service providers fix thousands of security issues and vulnerabilities over the past 3 years.


Super affordable rates.

Prices are dependant on size of the website/exchange and will be provided upon contacting me with your URL in private. A super detailed and thorough report will be provided at the end of the pen-test with all vulnerabilities as well as help/guidance/consulting with helping your team secure all critical vulnerabilities. Anything considered critical or high risk will have Proof of Concept's attached to the report so you or your team can re-create the attacks yourselves.

This is to be considered a highly cost effective route than paying for individual bug bounty submissions from freelance ethical hackers, or running an outsourced bug bounty program on Bugcrowd or Hackerone.

OVERDELIVERY GUARANTEED for ALL SATISFIED CUSTOMERS!

Price: $500 per day. Depending on the size of the platform you have, discounts will be provided for platforms that require multi-day pen-testing. This is not to be considered a be-all-and-end-all pen-test, as if it is connected to the internet, it can be hacked... in saying this, I have in the past week selected 3 ICO's or Cryptocurrency exchanges and completed a 1-2 hour pen-test and gained root access to their databases, (and submitted to admins of platforms), or made threads calling specific platforms out with garbage security issue-handling for their customers. Don't be the next exchange to be called out on Bitcointalk.

I have submitted bugs/vulnerabilities for 15 different exchanges/platforms in the crypto niche over the past 11 months, as well as 4 of the top Deepweb marketplaces currently operating. I specialise in SQLi (considered one of the worst and most lethal attacks you could have happen to your customer driven business website/platform).

References provided in private.

Delivery: 1-3 days.

Accept BTC, ETH, Bank wire.

Hi guys,

Back with more bad news it seems, (been exposing multiple exchanges recently being hacked and admins giving zero f*cks) Africunia [AFCASH] website was hacked back in May, and contact was made to the admins on Telegram (see screenshots) on May 31st~ and they were informed that their website was hacked and all databases were dumped, with root access gained.

The admin responded with little to no care, with threats to finish off the conversation. It was my understanding the site was then taken down for "maintenance" AKA resolving the issue. I should have known better.





Fast forward 5+ months later, and their site is still as vulnerable as ever, with customers logging in as recently as 1-2 weeks ago to withdraw AFCASH. phpmyadmin mysql database user hash was cracked instantly and all database(s) are available for dumping.



This is a warning to anyone who uses https://www.africunia.com or who purchased in their ICO a while ago, change your passwords (especially if you re-use passwords) and so forth. I am going to submit this to https://haveibeenpwned.com/ so people have multiple chances to see their data was involved in a breach.

Chat soon.

No one here is trying to hurt your cause, if anything I submitted a decent amount of serious vulnerabilities for FREE. So how is that hurting your cause?

All anyone here is trying to do is keep people safe by warning them to steer clear of your clearly shady/scam, poor excuse for a crypto exchange.

Their website is ridiculously vulnerable, use with absolute caution. Be ware of their claims for private funds, however large they claim to have when they can't even pay for bug submissions that can and will lead to their database being dumped lol

They use an outlook.com email address for support emails too.

Most likely because they have CloudFlare's UAM (Under attack mode) enabled. Which is misconfigured (horribly) as it wasn't effective at all against any penetration test that was happening on their site hours ago.

Care to respond to my earlier email? The first sign of trustworthiness (for me at least) in an exchange, is their responsiveness with security related issues and how they handle the process for bug submissions from start to finish. No one even responded to my submission (after the staff requested for me to send them over, whilst simultaneously informing me there is no paid bounty program in place...) - trust me, with how vulnerable your platform is, (WordPress  ) you're going to want to treat people like me who are submitting them, well, before some ass comes along and exploits them for their own financial gain.

Do you have a paid bug bounty program? I'd like to submit a number of bugs/vulns.

Can't say I am surprised with how they handled the news, essentially (I can only assume) Tim's response is implying I am hiding behind a fake account or something, (yet I gave him my work email to contact me on) and tried to downplay the seriousness of the fact their database and over 12,000 (of a purported 20,000) members details are leaked online. Tim also stated on Telegram to me that they used to use md5 hashing, and later changed to bcrypt after they "realised" a breach had happened in the past (yet they never informed their users of any such breach), yet 97% of the hashes in the leaked database are hashed with bcrypt, with the remaining 4% being md5. Many red flags here.

Users should always be informed of any breach. I'm going to submit this to haveibeenpwned.

Just finished speaking with Tim, he will be responding here shortly regarding this. Thanks for anyone who helped point me into the right direction to contact admins!

re: darknet market claims statement - whilst this can be true a lot of the time, this is 100% confirmed to be from bitcoinrush.io. Independently verified.

Thanks will do that shortly.


**Edit - just spoke to Tim, he said someone would be in touch with me shortly.

Can the admins of this company please contact me ASAP as your site has been hacked and the database is for sale on the deepweb. I've attempted contact over emails in mid September and no one cares to respond.

Also have a thread here - https://bitcointalk.org/index.php?topic=5195849.0

Hey guys,

So aswell as being the Director of Marketing for a cryptocurrency exchange, I double as a pen-tester/infosec researcher, and recently came across a database being sold on the deepweb purporting to be from BitCoinRush.io.

I obtained a copy and checked some of the logins against their website and to my surprise they worked. Albeit most of them were banned for suspicious activity, probably due to people logging in and attempting to rob the balances from IP's originating in different countries than where the user signed up from.

I contacted the admins via email ( https://imgur.com/a/S9nTh3h ) to no avail. And apparently from what I can tell, they most likely know but haven't informed their users, which is a real piece of crap move considering how many people these days re-use passwords across many websites and is the number 1 attack happening against people these days.

If you use this service please change your passwords immediately.


https://imgur.com/a/sAgn6Vh

We guarantee that they will be sent within 15 minutes. Policy is that orders are sent instantly and we cannot control the speed at which transactions confirm on the blockchain - but we always add a network fee considered to allow confirmation within 1-3 blocks.

Wow, how so much changes in a year and a half.. I remember when I first started out pen-testing, I submitted a bunch of bugs to Dean, that I found whilst pentesting Betking.io website and he paid in BTC, generally within 24-48 hours of submission, and paid well too. Little does he know I was literally using his website to learn, monetary incentive definitely helps you learn fast.

What a real piece of crap. What a shame.