Primedice.com | Since 2013 | Longest Running Crypto Casino | 113 BTC Jackpot!

[liie888coins]

The hufflepuff report as promised:

https://medium.com/@Stunna/breaking-the-house-63f1021a3e6d

Definitely not the most interesting PD story, but probably the most expensive.

Breaking the house
How Primedice was exploited for $1M in Bitcoin


This is the story of how we lost around $1 million worth of bitcoin to a hacker who exploited our online casino’s RNG system. This happened last year, but we’ve decided to share our experience for transparency and so that others can learn from our mistakes.

August 2014

Shortly after the launch of the third version of Primedice, our team faced an adversary that challenged the existence of our website. Our team had nearly two years of experience building bitcoin gaming sites, however none of our founders had any coding ability. We were under heavy pressure to avoid further delays and released after a short week of closed beta testing.

The heist began immediately after launch with two unusual players, Nappa & Kane. We noticed unusual betting patterns from both those accounts. Kane was automatically cashed out, we reviewed Nappa’s bets and thought they were highly unusual but could find no wrong-doing and cashed him out after a delay and a brief email exchange

September 2014

After getting spooked by his delayed cashout on Nappa, the exploiter waited a few weeks and created a new account named “Hufflepuff”. Hufflepuff was the largest bettor Primedice had ever seen, he was often seen betting upwards of $8000 worth of bitcoin every second for hours on end. Our entire team was shocked that Hufflepuff continued to beat the house edge (1%) and stack up more and more profit over time.

We were highly skeptical of his winnings and were forced to hold his cashouts time and time again to investigate and each time our developers could not find any wrong-doing. We heavily explored what we thought was every possibility, ran simulations and did the math and came to the conclusion that he was just incredibly lucky.

The Discovery

About two days after sending his final withdrawal placing him above 2037 profit on the Hufflepuff account alone, our main developer detected the exploit after we found a handful of accounts sharing the same server seed.

To understand how Hufflepuff beat our system, one must understand how our provably fair system (RNG) works. A user is shown an encrypted random value (the server seed) before they bet and they must also submit their own random value (the client seed). These two random values are combined and used to determine win or lose. The random encrypted random value used for the bet then is shown to the user after the bet so that they can be guaranteed that their bet is not rigged. You can find the detailed and in-depth explanations of provably fair here:

https://primedice.com/verify and http://dicesites.com/provably-fair

Part of the functionality of our site is that we have to give out decrypted server seeds (to assure users no bet manipulation has occurred) and put a new random seed in place, essentially trashing the old revealed seed. Hufflepuff found a way to “confuse” our server, and made it give out a decrypted server seed that was also an active seed. This was done by sending it more requests than it could handle in a small time period, think hundreds of requests in under a second. The result of this is that he knew all the information required to corroborate the outcomes of his bets. He knew whether if he would win or lose, and could wager accordingly.

We figured this out after frantically checking our servers after a eureka moment. We suspected something could have been going on and eventually realized the possibility of a timing attack described above. Our database had seeds that were both inactive and in use at the same time all connected to Hufflepuff. Along these “Schrödinger” seeds existed many seemingly unused seeds connected to the same accounts, indicative of the rapid fire of requests needed to obtain these.

Déjà vu

Unfortunately we detected this exploit after cashing out Hufflepuff and his handful of accounts 2400+ coins (roughly $1M at the time). Given the nature of Bitcoin there wasn’t much we could do but take it on the chin. We reached out to Hufflepuff via his bitcointalk forum account and demanded the return of the coins, however this backfired unbelievably hard. It turned out that our developer had improperly patched the glitch. In response to our message, Hufflepuff created a new account named Robbinhood and proceeded to rapidly win 2000+ additional bitcoins using a work-around to the patch. He was unable to cashout more than 50 or 60 coins this time around as our site hot-wallet was drained.

Shortly after he privately sent us this message which was preceded with the dox of a primedice employee:

“Your offer is declined. Your demands are laughable. I’m happy to walk away and leave you be, but if you’re going to take this further, then so will I. I don’t think you want this to go further. I actually enjoy this shit. Your move.
Oh, and by the way, there are some pending withdrawals that you need to process.”
And that was the day the house didn’t win…

Evidence for transparency and investigative purposes
Hufflepuff’s deposit address: https://blockchain.info/address/1BiPXmDrHm7VXZnWy6NnW1ZbPc4dcpfkH5

His primary withdrawal address: https://blockchain.info/address/14iS2UvcLK33xkC1K1qL1dhEbp49aiNfNp

Email: hufflepuff@anonymousspeech.com

RobbinHood withdrawals:

https://blockchain.info/address/14HQ67ZhmATviHi9RdYhbUriAGSFmJpYoB

— Note — : Nappa/Kane were two other usernames used early on, amongst many others.

Kane’s Withdrawal address: https://blockchain.info/address/18dMBap634aESPTeD3FGcAgJ2S9n4qtBTZ

Nappa Deposit address: https://blockchain.info/address/16h9ggSzUWdvagEJdNvWVYiUkytw6SJgiB

Nappa email: kritonian@outlook.com

Some IP’s used between accounts: 184.75.221.106, 184.75.223.34 , 151.224.50.156 , 76.179.22.16

Any information that leads to the return of the coins from this incident will be greatly rewarded. We invite you to analyze the above bitcoin addresses and find out where the bulk of the coins ended up if you have the skills.

It’s also important to note that this incident is proof of the strength of our integrity and provably fair system. If at any point we attempted to rig Hufflepuff’s bets (skip nonces etc) we would have instantly realized he was cheating and we would have 2400+ more bitcoins. Hufflepuff only took a brief break from playing after we halved our max bet, I believe he would have cleaned us had we never discovered what was going on.

Sorry for the long read,

Stunna & Primedice

Thanks for great sharing Stunna.

This was a lesson learn and I think you should have to think about improving your detection system so that it will not take you long to detect the next attack, if any.

[tspacepilot]

Here another link for you http://dicesites.com/tools and from the sites you can check that the probability to get 20x loss streak is about 0.00011637% . The number is close to zero but it is not impossible so with that being said, conclusion is that you are unlucky to have 20 + loss streak

More generally, the probablility that any set of rolls go a particular way is just the multiplication of the probabilities.  This also makes intuitive sense.  If you have one roll at 50/50 there's a .5 chance, but when you want two rolls at 50/50 on a particular outcome for each roll, consider with coins and H, T:

HH
HT
TT
HT

Those are the four possibilities, so getting any particulare one is a 25% chance, that is, .5*.5.  The patten continues with 3 rolls, there are 8 possible outcome sequences and the probabilitiy for any paritcular outcome sequence is .5*.5*.5 (ie, 12.5%).

If you want 20x, it's .495^20.  This is indeed a small number if you only roll 20 times then the chance that you guess the outcome of all 20 rolls in sequence is very small.  But if you roll 20 times, then another 20 times, you just doubled your chance.  If you roll a million times, it's another story.  So, you have to consider how many times you rolled if you want to decide whether any particular streak of 20 is "lucky" or "unlucky".

[FanEagle]

I repeat, 2 stricks streak of reds in over 20 bets placed busting my dice rolls!

That is pretty common thing to have in PrimeDice actually

How is it random rolls and how is it fair?

Pretty common? So I am rolling with 49.50% chance to get that roll right on a low bet and you say its pretty common to have 20 rolls rolling above 49.50 on a 100 provability chance?

On another place I betted 15 times over 30 and I got 12 times under 30 in a row, so yeah, anything is possible.

[tspacepilot]

I repeat, 2 stricks streak of reds in over 20 bets placed busting my dice rolls!

That is pretty common thing to have in PrimeDice actually

How is it random rolls and how is it fair?

Pretty common? So I am rolling with 49.50% chance to get that roll right on a low bet and you say its pretty common to have 20 rolls rolling above 49.50 on a 100 provability chance?

On another place I betted 15 times over 30 and I got 12 times under 30 in a row, so yeah, anything is possible.

The thing to realize about these patterns is that any one pattern is as likely as another because the events are independent.  As humans we imagine that  "over 50" 100 times is super-special, but in fact it's just as special as "over 50", "under 50" repeated again and again.  Any sequence of numbers is equally likely, that's the definition of random, independent events.

[grendel25]

I repeat, 2 stricks streak of reds in over 20 bets placed busting my dice rolls!

That is pretty common thing to have in PrimeDice actually

How is it random rolls and how is it fair?

Pretty common? So I am rolling with 49.50% chance to get that roll right on a low bet and you say its pretty common to have 20 rolls rolling above 49.50 on a 100 provability chance?

On another place I betted 15 times over 30 and I got 12 times under 30 in a row, so yeah, anything is possible.

The thing to realize about these patterns is that any one pattern is as likely as another because the events are independent.  As humans we imagine that  "over 50" 100 times is super-special, but in fact it's just as special as "over 50", "under 50" repeated again and again.  Any sequence of numbers is equally likely, that's the definition of random, independent events.

every single time the dice is rolled in just about every online dice site you have 'MORE' than a 50% chance to LOSE because of the house edge.  There's no special timer that gets reset to ensure a win after a certain number of losses.  It's more likely as time and rolls go on that losses will be replaced by wins and eventually balance out to 49.5% wins in a 50/50 roll. 

The idea that a win is more likely after losses is called the "Gambler's Fallacy".  Many betting systems are based off the gamblers fallacy that aims to hedge losses to an eventual win.  But the only way to ensure victory in the long run (24 hours doesn't even come close to the long run) is to have an infinite bank roll. 

[tspacepilot]

I repeat, 2 stricks streak of reds in over 20 bets placed busting my dice rolls!

That is pretty common thing to have in PrimeDice actually

How is it random rolls and how is it fair?

Pretty common? So I am rolling with 49.50% chance to get that roll right on a low bet and you say its pretty common to have 20 rolls rolling above 49.50 on a 100 provability chance?

On another place I betted 15 times over 30 and I got 12 times under 30 in a row, so yeah, anything is possible.

The thing to realize about these patterns is that any one pattern is as likely as another because the events are independent.  As humans we imagine that  "over 50" 100 times is super-special, but in fact it's just as special as "over 50", "under 50" repeated again and again.  Any sequence of numbers is equally likely, that's the definition of random, independent events.

every single time the dice is rolled in just about every online dice site you have 'MORE' than a 50% chance to LOSE because of the house edge.  There's no special timer that gets reset to ensure a win after a certain number of losses.  It's more likely as time and rolls go on that losses will be replaced by wins and eventually balance out to 49.5% wins in a 50/50 roll. 

Of course, I had simplified my discussion to a 50/50 scenario.  But in fact if you're talking about a house edge which makes win 49.5 then it's by definition not a 50/50 roll, that is a 49.5/50.5 roll.

The idea that a win is more likely after losses is called the "Gambler's Fallacy".  Many betting systems are based off the gamblers fallacy that aims to hedge losses to an eventual win.  But the only way to ensure victory in the long run (24 hours doesn't even come close to the long run) is to have an infinite bank roll.

Here you're absolutely correct about gambler's fallacy.

[Pierre11]

Primedice scammed me! I lost 0.31 to a glitch, and have yet to recieve a refund. They haven't even fixed the bug.

2/10 support, responded once asking me to "explain more". I responded with long paragraphs and pictures. 2 months later and no response.

Watch out! There's lots of bugs, you might be unlikely to encounter, but when they happen you will be mad!

[tspacepilot]

Primedice scammed me! I lost 0.31 to a glitch, and have yet to recieve a refund. They haven't even fixed the bug.

2/10 support, responded once asking me to "explain more". I responded with long paragraphs and pictures. 2 months later and no response.

Watch out! There's lots of bugs, you might be unlikely to encounter, but when they happen you will be mad!

Maybe you could 'explain more' here.  If you add your long paragraphs and pictures to this thread then surely you'll either get a bunch of people behind you (and Stunna will reply quickly) or else you'll get a bunch of people telling you why you're wrong.  In either case, you're sure to get a resolution.  After years of reputation building, it's simply hard for us to believe your unsubstantiated claims at face value.  Evidence is king!

[waterpile]

Primedice scammed me! I lost 0.31 to a glitch, and have yet to recieve a refund. They haven't even fixed the bug.

2/10 support, responded once asking me to "explain more". I responded with long paragraphs and pictures. 2 months later and no response.

Watch out! There's lots of bugs, you might be unlikely to encounter, but when they happen you will be mad!

It would have been a valid statement if you have no tons of neg rep.. Sorry mate but it seems you got busted and you want to get your money back lol
I think you're the only one reported this glitch excuse

[Hexcoin]

Primedice scammed me! I lost 0.31 to a glitch, and have yet to recieve a refund. They haven't even fixed the bug.

2/10 support, responded once asking me to "explain more". I responded with long paragraphs and pictures. 2 months later and no response.

Watch out! There's lots of bugs, you might be unlikely to encounter, but when they happen you will be mad!

this user is probably trying to extort PrimeDice with his so called "glitch" and losing .31BTC. your trust says it all, you are not trusted. post here your proofs or this is just another BS

[stingers]

Primedice scammed me! I lost 0.31 to a glitch, and have yet to recieve a refund. They haven't even fixed the bug.

2/10 support, responded once asking me to "explain more". I responded with long paragraphs and pictures. 2 months later and no response.

Watch out! There's lots of bugs, you might be unlikely to encounter, but when they happen you will be mad!

They seem to ignore the bug troll guys out there. There are too many people like you candy.

[asuspc]

Primedice scammed me! I lost 0.31 to a glitch, and have yet to recieve a refund. They haven't even fixed the bug.

2/10 support, responded once asking me to "explain more". I responded with long paragraphs and pictures. 2 months later and no response.

Watch out! There's lots of bugs, you might be unlikely to encounter, but when they happen you will be mad!

not a first time I have seen a whining gambler who just lost some money! how about you explain the bug here, those long paragraphs and pictures

[shanem]

Primedice scammed me! I lost 0.31 to a glitch, and have yet to recieve a refund. They haven't even fixed the bug.

2/10 support, responded once asking me to "explain more". I responded with long paragraphs and pictures. 2 months later and no response.

Watch out! There's lots of bugs, you might be unlikely to encounter, but when they happen you will be mad!

If this is true, you should tell the primedice support more information so that they can help you to recover your bitcoin.
This is necessary as it involves money and nobody will give away money easily.

[Mist]

Primedice scammed me! I lost 0.31 to a glitch, and have yet to recieve a refund. They haven't even fixed the bug.

2/10 support, responded once asking me to "explain more". I responded with long paragraphs and pictures. 2 months later and no response.

Watch out! There's lots of bugs, you might be unlikely to encounter, but when they happen you will be mad!

It would have been a valid statement if you have no tons of neg rep.. Sorry mate but it seems you got busted and you want to get your money back lol
I think you're the only one reported this glitch excuse

This user is also Candystripes. So yeah, dont listen to his bullshit.

[roadbits]

Primedice will it allow US players to play without using VPN or other methods

[cazkooo]

Primedice will it allow US players to play without using VPN or other methods

No Primedice block deposits from the US players already so if you want to keep playing here then you have to use VPN. Stunna will not allow US player to deposit anymore unless they purchase some license and become legal ofcourse

[Mist]

Primedice will it allow US players to play without using VPN or other methods

No Primedice block deposits from the US players already so if you want to keep playing here then you have to use VPN. Stunna will not allow US player to deposit anymore unless they purchase some license and become legal ofcourse

This is why it is becoming ever useful to have a vpn.

[tspacepilot]

Primedice will it allow US players to play without using VPN or other methods

No Primedice block deposits from the US players already so if you want to keep playing here then you have to use VPN. Stunna will not allow US player to deposit anymore unless they purchase some license and become legal ofcourse

I haven't yet put any of this to the test, but ever since he said that he blocks deposits from us-based players I've been wondering if he does this at the moment you generate the address for the deposit or if he flags an account which has been in the us ever as being us-based.  What I mean is that imagine that you fireup tor-browser and log into PD and request a deposit address, okay, so assuming you connected from a non-us tor-exit node all is fine, right?  You close down tor-browser and open up your normal browser and chat while you wait for your deposit to confirm.

It's a bit of a hassle, sure, but I think it's enough to offer PD the plausible deniability that they want.

Although, as I said, I haven't tested it yet so who knows, maybe Stunna's cracking the whip harder that I assumed.

[vrm86]

Hi. Two questions:

1) Is there any leveling requirements table?
2) What are the rules of using faucet? I mean, how often are you allowed to claim (times/24h)? I really like this feature, but definitely don't want to be accused of  exploit etc.

[glorg44]

Hi. Two questions:

1) Is there any leveling requirements table?
2) What are the rules of using faucet? I mean, how often are you allowed to claim (times/24h)? I really like this feature, but definitely don't want to be accused of  exploit etc.

You faucet will increase after 1 BTC wagered. I don't think there is any table for that. And faucet is to test sites not claim all day long, You should risk your own money if you want to gamble and claim winnings.