[ANN][EXCHANGE]Altilly Next Generation Crypto-Asset Exchange

[HodlerCompany]

And that shows how much of a noob you are. They have kept communication open, it is still there and they are not hiding anything.

Deposits not working days before the announcement of the hack, i made one deposit that did not receive, i saw in the chatbox that other users faced similar problems, so i waited, but i made a second deposit and keep waiting, then they announced they got hacked.
Deposits and Withdrawals for some coins like BTC, DOGE, LTC not working days prior the hack, then the exchange goes offline and they say is because the server rebooted and deleted the database.
Who is noob?
Those idiots didn't backup the Database? or replicated into another server? or have a raid? or tried to recover the files with any of the recovery tools available?
Don't you think smells like a scam?
Why they allow users like me to deposit if they knew they got hacked? if they really got hacked?
Now they are blaming that someone gained access to an email, and use it to access the servers, the database is gone, and they cannot give back the remaining coins.

Altilly is a Hodler Enterprises owned, secure, reliable and advanced digital asset trading platform,
developed by professionals and built on cutting-edge technology.



The Altilly trading platform provides trading services for innovative assets, while also providing instant trade execution,
dependable digital wallets and industry leading security practices.


We are committed to being a driving force in the blockchain revolution by increasing adoption of this innovative technology around the world.
Using our streamlined asset listing process, we will advance new, innovative blockchain projects that could
potentially transform the way goods, services and operations are managed globally.

 
Application Security
We use industry standard methods for preventing SQL Injection & XSS attacks on our website.
In addition, all passwords & sensitive data are encrypted along with a static & random salt.
Encryption keys and salts are NOT stored in the database nor in the codebase.
If we ever detect a possible intrusion, we will immediately lock down the entire system and re-encrypt all sensitive information with new keys.
 
System Oversight
We have automated systems in place to check for inconsistencies in transactions and our wallets.
The system will automatically shutdown a wallet if something appears incorrect, and immediately inform a technician.
The system status page will always have the most up to date information on any service outages or suspensions for an asset.


Hodler Enterprises
Website - https://hodler.enterprises
Qredit - https://qredit.io
Altilly - https://www.altilly.com
Bitilly - https://bitilly.com
Hodler Energy - https://hodler.energy
Antares Energy - https://antares.energy

The hacker(s) deleted the backup
All assets will be returned to users who provide documented proof

[1715629752]

1715629752

[1715629752]

1715629752

[1715629752]

1715629752

[safexscam]

The hacker(s) deleted the backup
All assets will be returned to users who provide documented proof

You are a fucking idiot, who is going to believe that you storage the backup in the same server where the Database is located?
And you didn't download a backup every few hours? I had a Wordpress blog, i installed a plugin that sent me the backup to my email every few hours, why you did not the same?
If the database was on a server that had RAID you can still recover the database from the second hard drive.

Altilly developed by professionals and built on cutting-edge technology

Altilly is a Hodler Enterprises owned, secure, reliable and advanced digital asset trading platform,
developed by professionals and built on cutting-edge technology.

This is BS

[drofxafm]

If the database was on a server that had RAID you can still recover the database from the second hard drive.

RAID only protects against drive failure, if the database was deleted from the server then it would have been deleted from all drives at the same time. If this was a dedicated server (rather than a virtual server) then the correct course would have been to switch the server off immediately upon discovering the deletion so that there was a chance of data recovery, but then switching off the server would also be the correct way forward upon detecting the hack as well.

From reading the various things said by the team I think these were a set of virtual servers probably on a shared provider (a mistake), what backups they might have had were minimal (a mistake), credentials seem to have been managed poorly (a mistake) the hack wasn't dealt with very well (a mistake).

Whilst I don't see enough evidence to call it an exit scam, there seems to be plenty of evidence of incompetence in how things were run and have been handled (why no announcement on twitter).

If things were setup correctly the hackers would have been unable to delete the backups and there would be a full audit trail on a separate server that couldn't have been altered, both simple things to achieve, both things that seem to be lacking.

[Bigpiggy01]

Communication can always be better but it's there open and transparent.

I'm not sure that Twitter would help at all as they have in many cases just made stuff way worse. That has spoiled several buybacks and caused additional hacking in several cases I can think of.

[bitcoinblog]

Their 5% return on investbox on BTC, ETH, USDT and LTC were suspicious as hell. It is also very convenient for them to have all data disappearing with funds. If true, it would make legal actions from customers impossible. It seems for now their favorite culprit is their "hosting provider". Personally I do not trust any word coming from them, as they haven't disclosed any info when it happened and just went on silent mode. The blueprint of an amateur exit scam.

It was a preplanned scam if i am not wrong , that is why they are giving lame excuses.

- Server got hacked
- Email also gone to host provider to delete server 
- Offline wallet also got hacked with the help of API 

they are thinking we are dumb and dont understand anything.

[GreenPanda]

Imo the theft is the work of probably only one person. But probably someone on the inside, for reasons I'm not aware of. Hearing the domain was basically stolen through an old inactive email from 3 years ago should help find who did this, as probably not many person were to be aware of that. I believe the rest of the staff at Altilly giving updates is genuinely affected too and are doing their best to sort things out. So thanks to the ordinary people stuck in this mess and doing their best, for my part, I'm not too affected so don't worry for me.

I also had a withdrawal that was confirmed but never went through over a week ago from RVN. Never cared because it was 27 RVN's...

Here is what I am asking myself since early december:
Their system status page had a deposit, withdrawal, and "safe storage" wallet. But where was that safe storage located? As it seems their funds were already funneled elsewhere. For example: in early december, when trying to withdraw a substantial amount of litecoins that was deposited only 3 days earlier, the litecoin withdrawal wallet of the exchange had to be put in maintenance for 12 hours so that my withdraw could be finally fulfilled. After that, in the system status page, the amount of litecoins, in safe storage, stayed exactly the same even though there was supposed to be a substantial amount of litecoin subtracted from my recent withdraw.

So the person allowing the withdrawals for litecoins and managing the maintenance during that time, had to know that something was going wrong, because I knew...

I recommend to the staff left at Altilly to look at who of theirs left the boat just before the shtf, because if someone on the inside caused that, he/she would left you hanging with all the troubles...

edit: after reading @drofxafm comment,  I agree that in the concourse of multiple mistakes, I think it may also be the work of an attacker maintaining stealth control over the exchange for weeks... only time will tell if we'll ever know...

[Twinkledoe]

Imo the scam is the work of probably only one person. But probably someone on the inside, for reasons I'm not aware of. Hearing the domain was basically stolen through an old inactive email from 3 years ago should help find who did this as probably not many person were to be aware of that. I believe the rest of the staff at Altilly giving updates is genuinely affected too and are doing their best to sort things out.

I also had a withdrawal that was confirmed but never went through over a week ago from RVN. Never cared because it was 27 RVN's...

Here is what I am asking myself since before the hack:
Their system status page had a deposit, withdrawal, and "safe storage" wallet. But where that safe storage was located? As it seems their funds were already funneled elsewhere. For example: in early december, when trying to withdraw a substancial amount of litecoins that was deposited only 3 days earlier, the litecoin withdrawal wallet of the exchange had to be put in maintenance for 12 hours so my withdraw could be fullfilled. After that, in the system status page, the amount of litecoins, in safe storage, stayed exactly the same even though they were supposed to be a substancial amount of litecoin substracted.

So the person authorizing the withdrawals during that time, had to know that something was going wrong, because I knew that the exchange was in deep troubles...

I recommend to the staff left at Altilly to look at who of theirs left the boat just before the shtf...

Seems another inside job here...Wanting to get out of this altilly project. I have seen a lot of related blockchain projects here by Hodler Company like the Qredit, Hodler Mining, Hodler Energy, Voyager Park and I believe they are not really doing good in those ventures. They are venturing into several businesses, and yet, I haven't seen them really prosper even with this altilly exchange. Now, somebody decided to siphon some funds, which is not really good because they have small trading volume only.

[paramind22]

Who keeps proof of their assets at exchanges?  It's a good idea but I've never seen it discussed before. 

[Bigpiggy01]

Who keeps proof of their assets at exchanges?  It's a good idea but I've never seen it discussed before. 

That is an epic idea the problem comes in with the centralized custody part. If should however be possible with the right type of logic framework that would be something that could move things along dramatically as right now it is still the same as it was with WBX 10 years back 

This would be an clunky to run but that might not be a bad thing.

[GreenPanda]

Not a bad habit to take screenshots of what you hold on exchanges. But a proof of assets can easily be falsified on the user side. And for the exchange side, we've seen that data security is an issue.

[safexscam]

At this moment i lost hope, the total amount i lost was 27$, it doesn't worth the effort to proof my two deposit,
they will probably make it hard to recover, like asking for KYC, at this moment i will move on & stop staking useless shitcoin, i still have a big amount of coins that i am staking, but unable to sell because it was only traded here.

[GreenPanda]

I'm starting to follow a bit my deposits addresses to Altilly and I realized that the ethereum withdraw wallet (possibly) of Altilly hasn't moved since the exchange went down, and still has over 24 ETH in it:

https://blockchair.com/ethereum/address/0x1a2c9c848d9e9df10d45dd736fde9910d21e56b9

On the other hand:

one of Altilly's active Litecoin address was already empty on december 24th:
https://blockchair.com/litecoin/address/LVJEMLwEFwmWb4P6qoXLX4bC7MwqjHJGZ7

one of Altilly's active Dogecoin address was already empty on december 25th:
https://blockchair.com/dogecoin/address/DFnP5y1fpU6snYGkQHKK53mYmXeXgiXvQ7

one of Altilly's active Bitcoin address was already empty on december 24th:
https://blockchair.com/bitcoin/address/334eYEeRNj6XkSpq411Gs5DfZAFVtVmqG1

above is one of the address Altilly started to use for deposits on october 28th, before this date it was:
https://blockchair.com/bitcoin/address/12TqdX5Rz1sPFejJ6Qz84NzgHz4JuuH7q1

My theory is that the "safe storage" wallets were compromised. For a while, customers deposits were covering for others customers withdraws. But those behind the theft couldn't cover it anymore. So the servers were wiped off.

[psycodad]

And now you need to claim your balance within 60 days - but first you need to sign up to google so you are able to fill the claim form...

Click on the button below to fill in the form so we can establish the users affected by the Altilly Exchange hack.


Please note. You will have 60 days from today, to fill in the form. You can no longer claim your funds once these 60 days have passed.
Final date is: 26th of February 2021 - 23:59 CET.

What a frickin gong show...

[00HasH]

It's Christmas 

[Bigpiggy01]

And now you need to claim your balance within 60 days - but first you need to sign up to google so you are able to fill the claim form...

Click on the button below to fill in the form so we can establish the users affected by the Altilly Exchange hack.


Please note. You will have 60 days from today, to fill in the form. You can no longer claim your funds once these 60 days have passed.
Final date is: 26th of February 2021 - 23:59 CET.

What a frickin gong show...

Yup but still significantly better than how it has been handled in a lot of places.

[drofxafm]

And now you need to claim your balance within 60 days - but first you need to sign up to google so you are able to fill the claim form...

Click on the button below to fill in the form so we can establish the users affected by the Altilly Exchange hack.


Please note. You will have 60 days from today, to fill in the form. You can no longer claim your funds once these 60 days have passed.
Final date is: 26th of February 2021 - 23:59 CET.

What a frickin gong show...

And they've now quietly changed that to:

Please note. You will have 14 days from today, to fill in the form. You can no longer claim your funds once these 14 days have passed.
Final date is: 9th of January 2021 - 23:59 CET.

[GreenPanda]

There is an update posted yesterday about the cause of the theft, go see the website.

[HodlerCompany]

We are currently reorganizing our plan on how we will be refunding saved assets.  These will be refunded by the project name in alphabetical order and updated on website as we work on them so all can see the progress and know what to expect and when. We appreciate your continued patience as we continue trying to get user funds back to those we are currently able to

Today, January 25th 2021 the deadline for filling out the form will have been reached.  You have only a short time left to file your claim for lost assets. We have left the form open for 30 days to allow all who have lost assets on Altilly to file your claim

The form will be closed and gone after today

FYI: The form was originally going to be held open until Feb 26.  This has now changed.  We need all claims to be in before we can start sending  the majority of refunds and at this point we are going to assume that anyone who cared about their assets on altilly has by now filled out the claim form.

99% of claims coming in now are from fakes and scammers

[HodlerCompany]

The form for submitting a claim has now been removed. No further claims will be accepted

[HodlerCompany]

UPDATE:
We are currently processing refunds for saved wallets in alphabetical order.
42Coin, MRX, Aeon, Alias, and AFRO are being processed now
If you filled out the form for refund before it closed you will be receiving an email
from our customer support team via freshdesk requesting information regarding your
claims for the above assets.