Will get chat sorted soon.

All the people invested in Primedice are long term believers of Bitcoin and have faith in the technology. A few coins have been sold to cover living expenses but that's about it. We're also hoping to up our maximum payout to 80 BTC rather than 40 BTC soon to further accommodate larger bettors, as we've noticed many people recently being limited by our current cap.

With that being said, I can't say the 'crash' has been much fun to watch, but at the end of the day we've seen a lot lower

Will consider offering this for new accounts, ultimately if the user enables 2FA it should act as a pretty significant shield from unwanted access though.

I'd like to finally weigh in and end speculation that there was some sort of lack of security in our system and describe what I believe happened. When I first heard the news of this I knew 100% that diceminer was telling the truth, he was a frequent large bettor on the website and had no reason to lie about this happening and I spent a significant amount of time looking into this. I didn't really want to share this as some information was a bit sensitive but for the sake of transparency I'd like to fully detail what happened.

The situation as stated in the thread
On 2014-09-21 17:28:25 a 99.9999BTC cashout was sent from diceminer 2 to 47c18d5c3448a713608e78abb9569263ef4d780648ccd5dceff04c325d116691 (1PrZQH8L7aU9qyhbgLvm4zNjfoC1wGevAs) This cashout was sent from either the cashout modal or API.

What we knew at the time
Ultimately we didn't have any ip logging in place beyond account creation so I couldn't determine what ip hijacked the account but we were able to determine that the cashout was sent from the cashout modal or API there was nothing done server-side.  I narrowed it down to either someone guessing/cracking his password or a script containing malware. However, diceminer says he was not running a script at the time so I narrowed it down to some sort of password attack. In terms of primedice password security, we go far beyond standard password hashing to secure accounts, PD couldn't figure out a user's password if we wanted to.  It's also important to note that diceminer had completed several other 100 coin deposits and numerous cashouts prior without issue and since the incident there have been a significant increase in 100+ coin deposits/cashouts and no issues.

The Investigation
I was secretive about what had happened as I ended up setting up logs on diceminer's account to try and find out who was accessing it as this was a serious theft. I attempted to bait out the person by putting coins on the account and then blocking it from cashing out, only one person ended up cashing out the "trap" cashout and that was diceminer himself unfortunately. I reloaded the account but there were no recorded cashouts after that. I was hoping to have an ip to tie to the address the coins were sent to and place a bounty for more information or connections but this did not pan out, the thief didn't come back for seconds.


I scrambled for a period of time worrying that our security had somehow been compromised but all other funds remained secure and then I got this message:

Note: the password has since been changed and the account is now blocked from cashing out, I've also ensured that diceminer is not using this password for anything else and gained his permission to post this:


After I got this message I was pretty upset this wasn't revealed at the beginning but I understood diceminer's reason for withholding it and continued to investigate regardless.

After this information was provided to us, our team determined that the most likely outcome is someone literally just attempted to guess the password in a few attempts and got lucky or attempted to bruteforce the account after it was spotted on highroller for very basic passwords such as the username or password. I previously said there definitely wasn't a bruteforce but it was definitely possible, we do have an anti-login bruteforce though so unsuccessful logins are counted towards limit which makes this unlikely though. There still isn't much we could do on top of our current system to prevent this other than banning users from setting insecure passwords such as their username, no other highrollers were effected fortunately either due to stronger passwords or a lack of a password.

We value user privacy and try to log as minimally as possible which made it very hard to 100% determine what happened but I can conclude that there was no concerning fault in our system other than a lack of a 2FA option which has since been added. If the user ran a script though then there is no way for us to defend against that, I had some concern that this was the case here as this occurred a day or two after someone started spamming chat with the "PD Exploit" script and his video contained the greasemonkey add-on but I'll trust diceminer's word that no scripts were involved.

I'm sincerely sorry that diceminer lost his coins, I spent the past two weeks trying to log the ip of the person who did this in hopes that we'd have at least  something minimal to go off of but was not successful in this attempt. It's extremely unfortunate for diceminer, I was really upset when I found out about this but I will say that I did not take this lightly and spent countless hours each week looking into possibilities and trying to catch the person involved. Ultimately we will do everything we can to provide the best possible security we can, but it is up to the users to set a secure password and enable the now possible 2FA. The simple fact is during this time frame we've had countless of 100+ coin deposits and withdrawals that went through swiftly and without issue and I have no doubt that user balances are secure. If any deposits were ever robbed from a user due to a direct fault in our system I would immediately without question replace it with my own funds, I have no reason to believe this was the case here.

Conclusion
I conclude that the 100 coin loss was most likely  a result of the weak password matching the username of the account which allowed a thief to successfully commit a simple password guessing attack which could only have been prevented by us banning weak passwords, providing 2fa at the time or by the user setting a more secure password. It's important to note that we had sufficiently strong brute-force/guessing limits in place which is why I feel that this attack was not automated and was simply a random person manually plugging in a few password attempts on the account and getting lucky.

Many of diceminer's coins appear to have been sent here https://blockchain.info/address/1FsVcdeHbpvUVT3gjeuVR2ZSDnpcsJMsLL  . Anyone with any information regarding this should shoot me a PM as I'll continue to do what I can to help him recover his lost coins. I thank diceminer for his cooperation and understand throughout all of this, I'll keep my eyes and ears open to see if anyone has any information.

1. Your website claims to be "provably fair" for investors, this is a blatant lie.

2. There is a mountain of evidence that you are giftcoins / luckynumber / zeeshanblc . You could actually start viewing some of the evidence and try to refute it instead of claiming it is all one giant coincidence.

3. It's extremely pathetic that you purchased a default trust account just to leave me negative feedback in retaliation. Supposedly the same account claims to have invested 300 coins on the site.


All bitcoin dice investment schemes could very well be scams, but in this situation I'm 100% certain that yours is.

Why not be the best of both? But in all seriousness I agree with your sentiment. I think we will end up significantly nerfing the faucet to only be a fun bonus for new users, entirely changing it to a once/twice a day daily reward or removing it entirely. I think any of these choices will result in a major backlash from the people who use the faucet, many of them think they are entitled to the rewards as they gained levels so they could use it and think that any nerf is robbery. The amount of support emails related to the faucet is staggering and has made it harder and harder to finish more important ones in a timely manner.

The key way to sort out this situation in my opinion is creating a system which rewards people with higher levels without being as expensive/gimmicky as the faucet. Ideally I want to make the faucet a minigame that can be played once or twice a day with scaling rewards based on level.

This is a bit vague could you PM me what's this regarding? Heading off for the time being as well.

Looking for ways to break faucet bots/solvers at the moment. When we changed the captcha to solvemedia faucet claims immediately decreased by 60%+ temporarily then moved up. Also if anyone can provide me input on which update we should prioritize I'll consider doing so.

I PMed you prior to leaving them negative trust in hopes you'd get paid. Perhaps they will refill the wallet and pay you though depending on the amount.

If not I'll send you any info I have on them.

Thanks for the update. Pretty safe to say this is a case closed. Keep eyes peeled for their next account/investment site iteration. Investment dice sites are never provably fair for investors, don't waste your money investing on them.

Some of the information in the post I've typed up is somewhat sensitive with regards to diceminer, I've messaged diceminer to let him know prior. Once he views my PM's I will post the story in full detail.

Also, I'm not sure if account selling is still allowed on this forum but it has been proven to almost exclusively been used for fraud purposes or to spam for signature campaign money. Theymos needs to come out and condemn it if this is still the case which I believe it is.

Account being accused:

https://bitcointalk.org/index.php?action=profile;u=33070

I have strong reason to believe this account was sold, it has not made posts in over a year and returned a week ago to launch a new dice site which happens to have the 100% exact new planned design of luckynumber.me a site which was proven to engage in fraudulent activity*  If a mod were to check this account I guarantee a brand new email was attached to it this week.

*source:
https://bitcointalk.org/index.php?topic=621659.0
https://bitcointalk.org/index.php?topic=582687.0


The investment site's thread
https://bitcointalk.org/index.php?topic=809026.msg9064177#msg9064177

I'm guessing my post on that thread will be deleted as it is self-moderated. Note, he immediately deleted my post noting my suspicions a few minutes later.


I left negative trust on the account "zeeshanblc" after I noticed he was farming up trust to post the next luckynumber investment dice site launch. Shortly after that this new account RandyFolds seems to have been purchased to promote the new website as zeeshan was no longer viable.  



Don't invest funds in onedice, I strongly believe they will play against the house and scam them. I've never accused someone of scamming who was not later proven to be a scammer.




And here's even more evidence for people who don't trust my word. I'm 100% certain that this is luckynumber. I will not let someone who wronged me in the past get away with repeated fraud and I will continue to be on a constant lookout for his next account which will inevitably come.

Whois Information


ONEDICE.ME WHOIS
Domain ID:D13336627-ME
Domain Name:ONEDICE.ME
Domain Create Date:31-Aug-2014 19:36:48 UTC
Domain Last Updated Date:04-Sep-2014 09:03:38 UTC
Domain Expiration Date:31-Aug-2015 19:36:48 UTC
Last Transferred Date:
Sponsoring Registrar:Tucows Inc. R99-ME (69)
Created by:Tucows Inc. R99-ME (69)
Last Updated by Registrar:Tucows Inc. R99-ME (69)
Domain Status:TRANSFER PROHIBITED


Luckynumber.me (proven fraud)  WHOIS
Domain ID:D11397696-ME
Domain Name:LUCKYNUMBER.ME
Domain Create Date:17-Feb-2014 17:10:46 UTC
Domain Last Updated Date:18-Apr-2014 20:50:09 UTC
Domain Expiration Date:17-Feb-2015 17:10:46 UTC
Last Transferred Date:
Sponsoring Registrar:Tucows Inc. R99-ME (69)
Created by:Tucows Inc. R99-ME (69)
Last Updated by Registrar:Afilias R54-ME (700001)
Domain Status:OK



More evidence:

Check the meta tags on both onedice and lucky number..

<meta name="title" content="LuckyNumber - Bitcoin Gambling Casino - Bitcoin Faucet - Provably Fair" />
<meta name="description" content="LuckyNumber is provably fair Bitcoin dice game and bitcoin casino. We offer the lowest house edge, chat, instant payouts, autobetting bot, and a bitcoin faucet." />
<meta name="keywords" content="bitcoin dice, bitcoin gambling, bitcoin casino, bitcoin faucet, BTC faucet, BTC casino, BTC gambling" />

<meta name="title" content="OneDice - Best bitcoin casino | bitcoin dice | bitcoin gambling | Invest"/>
<meta name="description" content="OneDice is provably fair Bitcoin dice game and Bitcoin casino. We offer provably fair BTC gambling, instant payouts, auto betting, invest option, free BTC faucet and chat."/>
<meta name="keywords" content="bitcoin dice, bitcoin gambling, bitcoin casino, bitcoin faucet, BTC faucet, BTC casino, BTC gambling, be the bank, invest BTC, invest bitcoin"/>

It's a copy paste from the previous sites for the meta/seo stuff.

pics: http://puu.sh/bXrl0/a57966e135.png / http://puu.sh/bXrlY/e3d38aae5e.png

I already agreed to do so, I appreciate the opinions of the mods but that was already decided on so there is no point in continuing to debate this.



Just changed it so it only advertises 10+ btc bets now. I can further limit it to a max amount of advertisements per 10 seconds as well.

It's because his password was not bruteforced, we have measures to prevent this and server logs indicate this wasn't the case at all. I'll post the full story tomorrow.

There is massive misinformation in this thread as usual. There was no "nonce" issue with primedice, you are thinking of dicebitcoin.

On primedice 2 the edge was 1.01% instead of 1% as advertised when betting on 2x due to how the numbers were rounded. This effected an extremely small amount of bets above faucet amount, there is a 1/10,000 chance your bet was effected. On the highest payout though the edge was more-so effected but there weren't really any significant sized bets made at that payout, almost exclusively faucet bets. No rolls were manipulated the edge was literally just 0.01% more than advertised. This was disclosed to us after PD3 had already launched with a system that seems to definitively be 1%. Obviously this wasn't intentional and the effects were much more minimal than I initially thought from what we've seen so far.


Lain's logic isn't exactly sound, he was offered a refund + bonus but believes that his betting decisions made were effected by that loss. I'm willing to look into it not because he is right but simply because the cost will likely be extremely minimal if anything at all (if he won the bet after then it wouldn't matter) and because I want him to be satisfied. @lain I responded to your email earlier today, should have more on the weekend, as I've said though it is highly unlikely it effected a large martingale series granted how many bets you've made.


With regards to the promised giveaways, the 1B giveaway was a lot of fun and I'm thinking up some ideas for the near future, open to suggestions.

Looks neat but I agree you should definitely consider open-sourcing, otherwise I don't think many people will use it.

Menu was fixed a few days ago, some modals are still a bit too big but everything seems to serve its base purpose for now.

Supposedly bets made on slot machines account for up to 85% of a brick and mortar casino's profit*. I'd imagine the majority of these bets aren't very significant in size but edges on slot machines can reach as high as 10-15% depending on the location. Also if you're playing slots at a less reputable place like a shady restaurant or bar I've heard of some machines being "rigged" in a similar manner as many crane games, only generating a jackpot/big win after certain profit thresholds have been reached thus guaranteeing profit for the operator.  

With regards to Primedice, non-highrollers probably don't account for much profit in the short run, perhaps just enough to cover expenses. Small whales are frequent enough to provide a constant stream of profit while whales of this magnitude are so rare that it is usually pretty hit or miss but it all seems to work out for the house in the long run.


The recent whale on PD wagered over 25,000 between two accounts and still managed to turn a profit of 100+ which is unusual granted the volume & number of bets, he had some insanely lucky recoveries. He advertised another dice site after he won and I've heard that he's won significantly elsewhere. However, there are always people who seem to defy the expected odds in a much unluckier way.

This is from two days ago:



*Reference: http://www.vox.com/2014/8/7/5976927/slot-machines-casinos-addiction-by-design

Insane day for Primedice today, appears to have been over 25,000 coins of wagers today just between two accounts!


The most notable whale(s) of the day were:





-stats via pd3.co (credit to nahtnam)

Winpleaseee seemed to flop between -150 to +100 several times before finally ending his session. Grats to the winners, had a lot of fun watching this go down.


Will get some graphs for tomorrow.


Reminder that our API is available at: www.primedice.com/api  already seen some pretty neat stuff made with it.