Bustabit: scam or hack, you be the judge.

[justlooking17]

We all remember March 2019 hack by bignut74, btcmonkey348 and buster192 where entire hot wallet was emptied. At that time Daniel, the owner of bustabit.com had no choice but to admit to a hack and existing vulnerability to a web socket. A connection between gaming server and web server has been compromised and an attacker was able to see a bust of the game in progress allowing riding it all the way to the bust insuring maximum profit from each game. Well, looking at the graph of bignut74 it does not take a genius to see that the user did NOT play consecutive games and won big 8 games in the row. The only logical conclusion is that the bust was known before the game started, and not during the game.
After bignut74 hack the patch has been applied and Daniel refunded the lost to investors. Since the March 2019, not that I was actively looking for it, I have noticed 3 users that graph looked, somewhat interesting.  Users Marketmaker, idexExchange and very recently itsjustChuckless have followed similar pattern. As there may be more users, I only spotted these three.
1) All users logged on and played for short period of time and very small number of games.
2) All users ended at very specific or close to specific total of winnings, as they had a set limit.
3) All users followed same pattern, as they did know the bust of the game in progress, but not before.
4) None of these have been publicly announced as a hack.
Let’s assume this is a hack; Given that Daniel and his staff is keeping very close tabs on the game and any abnormalities are detected it is very odd that the same wining pattern continues. Very simple database query can be run as often as one desire to detect “quick” winners that are able to cashed the game i.e. at 14.07x and game busted at 15.68 and within little over 100 games user walks away with 10 BTC in winnings.
However if this is not a hack, then someone from bustabit team is taking advantage of privileged information and using it by himself or releasing it to third party. If this is truth then this is a theft from players and investors.  The three users I have mentioned walked away with total of 22 BTS there in today’s exchange rate is little over a quarter of a million USD.
I have contacted the support at bustabit and this is a copy of the email exchange I had with Daniel, Keep it in mind that the order of messages is in reverse and the only edit I did was to remove Daniels and my last name.

Hello,

I can reassure you that I have no reason to believe that any of these users were cheating in any way. Their bets do not strike me as suspicious.

Kind regards,
Daniel


Marcin:
Thank you for your respond.

Please take a look at the graphs of these users. You are very smart
person, I am sure you can figure it out.

The play/win pattern , betting style, cashouts and final total.

Would this be a hack or something else?



On 8/8/2019 12:41 AM, Daniel wrote:
Hello,

Please clarify your question or how I can help you.

Thanks,
Daniel


Daniel at bustabit:
User: (anonymous)

https[Suspicious link removed]xchange
https://www.bustabit.com/user/Marketmaker

[1685819674]

1685819674

[1685819674]

1685819674

[1685819674]

1685819674

[1685819674]

1685819674

[BitcoinGirl.Club]

However if this is not a hack, then someone from bustabit team is taking advantage of privileged information and using it by himself or releasing it to third party. If this is truth then this is a theft from players and investors.  The three users I have mentioned walked away with total of 22 BTS there in today’s exchange rate is little over a quarter of a million USD.

I hope this is not true but looking at the incident this needs an investigation. Also, can you come up with some evidences so that we the visitors can see the data?

So the user accounts are:
Marketmaker, idexExchange, itsjustChuckless, bignut74, btcmonkey348 and buster192?

[numanoid]

The person (might be) you mentioned was tried to sell his strategy for only 0.46 btc https://bitcointalk.org/index.php?topic=5173020.msg52099218#msg52099218

Do you think he is the real?

I doubt bustabit is scam, they have been in gambling world for many years

[StackGambler]

It's important to understand that the bug was exploited via a websocket query, which is detectable. It's also important to understand that Daniel works alone (he does not have a support team and he certainly does not expose the hashes to more people than necessary, which is one).

If you look at the three usernames in a vacuum, I can see how you think it's suspicious. However, the same user has made multiple accounts. I've been following this user very closely (since he's scammed me of a large amount in the past, and I have pending litigation against him). Here is a small list of a few of his recent names:

idexExchange
HelloMisterRyan
HelloMisterDaniel
Dudewtfman
100kProfitEasy
Easy1Bitcoin
OnlyNeed200K
JustWant200k
1BTCGANG
1BTCMEME
CrazyBetter
aCrazyBetter
CrazyBettingStyle
HitThatProfit
CrazyGuyMan1
MakingProfitss


You will notice that most of the accounts have the same betting style; they also play for short durations and cash out when the target is hit. This doesn't always work, of course (most notably on the account https://www.bustabit.com/user/CrazyGuyMan1, where the player lost 28 BTC, almost all of his recent profit).

So, yeah, it's not a hack, and I would trust Daniel's word.

[justlooking17]

Pamoldar, if you wish to see users stats follow the link on original post and then replace username on the end to see other users statistics.

https://www.bustabit.com/user/Marketmaker
 or

https://www.bustabit.com/user/bignut74

[BitcoinGirl.Club]

Pamoldar, if you wish to see users stats follow the link on original post and then replace username on the end to see other users statistics.

https://www.bustabit.com/user/Marketmaker
 or

https://www.bustabit.com/user/bignut74

Yeah I tried but for some reason I do not see it's loading in my side. It's hanging there for ages.



By the way, I am no expert however I really think they need someone expert to investigate it.

[justlooking17]

Try to log-off your vpn,
enable javascript
try other browser.
Bustabit.com is very stable with chrome.

[dunfida]

Try to log-off your vpn,
enable javascript
try other browser.
Bustabit.com is very stable with chrome.

Tried to look this one https://www.bustabit.com/user/Marketmaker - I dont see anything wrong with it, having 44 games with big bits bets and cashed out with high multiplier
would really give out that significant net profit.

[Bitinity]

So you are trying to say that Daniel does not notice about the hack or he is letting the hack to make investors lose their investment money? Sorry for asking, but I dont get the idea of this topic since there is no solid evidences to be called as scam/hack. I believe Daniel is very trusted person in this community so I dont think he is saying the truth that there is no suspicious thing from mentioned bustabit's users.

[RHavar]

As an investor, I think this is a bit silly.

If there was a hack (or scam), investors would be hemorrhaging money. But in fact, the exact opposite is happening:

Investor profit over 1 day: -4.056 BTC
Investor profit over 3 days: 13.60 BTC
Investor profit over 7 days: 127.81 BTC
Investor profit over 30 days: 322.39 BTC
Investor profit over 6 months: 1578.59 BTC
Investor profit over 1 year: 3070.17 BTC


You'll see investors have done way better than expected.  And that's on top of the money that Daniel paid out of pocket to compensate for the attack API bug that allowed a person to know the outcome of the current game.

So right from the start there looks nothing suspicious.


So of course some players win, and some players lose. And some of those players that win is like WTF and some of the players that lose are like WTF.

A connection between gaming server and web server has been compromised and an attacker was able to see a bust of the game in progress allowing riding it all the way to the bust insuring maximum profit from each game. Well, looking at the graph of bignut74 it does not take a genius to see that the user did NOT play consecutive games and won big 8 games in the row.

The connection wasn't "compromised" there was just a bug in the API that allowed the client to trick the server into giving out the current game result. Note: You have something like 5 seconds between the GAME_START event and GAME_STARTED to place. So the obvious way the attack worked is when the game went into GAME_START the person abused the bug to know the game result, and decided to bet or not.  Anyway, that's long been patched and all investors were made whole.

The three users I have mentioned walked away with total of 22 BTS there in today’s exchange rate is little over a quarter of a million USD.

That's really nothing. They could win 10x that, and it wouldn't be that much of a statistical anomaly considering the size of bustabit's bankroll and action it's received.

[kingcolex]

The person (might be) you mentioned was tried to sell his strategy for only 0.46 btc https://bitcointalk.org/index.php?topic=5173020.msg52099218#msg52099218

Do you think he is the real?

I doubt bustabit is scam, they have been in gambling world for many years

Yeah you don't sell the golden goose for .46 btc and increase the chances of it becoming known or fixed and get caught. These people are thieves but they obviously aren't stupid.

[el kaka22]

I agree with RHavar (as always) because it has been a very very small amount, do you really think that if there was a hack they wouldn't really abuse it more?

If I have a hack of a website I would personally of course let them know in exchange for a bit of "gift" hopefully (even without gift I would just let them know) but lets say I am a bad person and I want to abuse a casino, I would totally get as much as I can and withdraw as much as I can to empty the hot wallet as a whole before anyone figures it out, whats the point of getting small by small when everything is traceable so people would totally see it and would cut it before you can make too much money. Hence, I think it was a hack and it happened but now it is long gone, whatever these guys are doing it is just a happy coincidence for them.

[devans]

I already had a closer look at the accounts after you emailed me, but as I mentioned nothing indicates that the players cheated or that there's any other sort of problem. Their results are not outside the ordinary of what you'd expect to see.

[docthusinh]

You can't accuse someone who played and won as a cheater, if he managed to get in between webserver and database server the best way is to alter the balance of his account and withdraw fast. He doesnt need to keep betting to wait for the admin to catch him.

Basically burst game is similar to dice game in term of logic and there is way to win on dice game, thus if the same winning strategy taken over will work.

[tsaroz]

It's important to understand that the bug was exploited via a websocket query, which is detectable. It's also important to understand that Daniel works alone (he does not have a support team and he certainly does not expose the hashes to more people than necessary, which is one).

If you look at the three usernames in a vacuum, I can see how you think it's suspicious. However, the same user has made multiple accounts. I've been following this user very closely (since he's scammed me of a large amount in the past, and I have pending litigation against him). Here is a small list of a few of his recent names:

idexExchange
HelloMisterRyan
HelloMisterDaniel
Dudewtfman
100kProfitEasy
Easy1Bitcoin
OnlyNeed200K
JustWant200k
1BTCGANG
1BTCMEME
CrazyBetter
aCrazyBetter
CrazyBettingStyle
HitThatProfit
CrazyGuyMan1
MakingProfitss


You will notice that most of the accounts have the same betting style; they also play for short durations and cash out when the target is hit. This doesn't always work, of course (most notably on the account https://www.bustabit.com/user/CrazyGuyMan1, where the player lost 28 BTC, almost all of his recent profit).

So, yeah, it's not a hack, and I would trust Daniel's word.

I've watched most of these ID playing. It's not that they were fail proof or any suspicious behavior or strategy. They just had a target which on achieved, stopped playing with that ID and created a new one. And most of the wins from the previous IDs were mitigated with the loss of CrazyGuyMan1, he even chatted exclaiming his failure. So, I don't think there's any suspicious activity going with this person.

[kingcolex]

It's important to understand that the bug was exploited via a websocket query, which is detectable. It's also important to understand that Daniel works alone (he does not have a support team and he certainly does not expose the hashes to more people than necessary, which is one).

If you look at the three usernames in a vacuum, I can see how you think it's suspicious. However, the same user has made multiple accounts. I've been following this user very closely (since he's scammed me of a large amount in the past, and I have pending litigation against him). Here is a small list of a few of his recent names:

idexExchange
HelloMisterRyan
HelloMisterDaniel
Dudewtfman
100kProfitEasy
Easy1Bitcoin
OnlyNeed200K
JustWant200k
1BTCGANG
1BTCMEME
CrazyBetter
aCrazyBetter
CrazyBettingStyle
HitThatProfit
CrazyGuyMan1
MakingProfitss


You will notice that most of the accounts have the same betting style; they also play for short durations and cash out when the target is hit. This doesn't always work, of course (most notably on the account https://www.bustabit.com/user/CrazyGuyMan1, where the player lost 28 BTC, almost all of his recent profit).

So, yeah, it's not a hack, and I would trust Daniel's word.

So he's betting with logic and skill, that can definitely be quite the deadly combination, good for him then if it isn't a hack and just the skilled user but as you can see with the 28 Bitcoin loss there is no fool proof way to beat the system. (Ouch)

[legendster]

So you are trying to say that Daniel does not notice about the hack or he is letting the hack to make investors lose their investment money? Sorry for asking, but I dont get the idea of this topic since there is no solid evidences to be called as scam/hack. I believe Daniel is very trusted person in this community so I dont think he is saying the truth that there is no suspicious thing from mentioned bustabit's users.

Yeah me too, seems like just a post about how similar two or more accounts (clearly way too many) have the same betting strategy. How is that indicative of hack? But yeah, if you consider having a VPN and creating multiple user accounts and hacking the system into believing that there are multiple users playing then yeah, you could call that a hack.

However, there is no intention or a little reward for site admins to catch these shady accounts. After all, they bring activity, which is good for attracting new users.

[RHavar]

Yeah me too, seems like just a post about how similar two or more accounts (clearly way too many) have the same betting strategy. How is that indicative of hack? But yeah, if you consider having a VPN and creating multiple user accounts and hacking the system into believing that there are multiple users playing then yeah, you could call that a hack.

However, there is no intention or a little reward for site admins to catch these shady accounts. After all, they bring activity, which is good for attracting new users.

FWIW, bustabit has never had a problem with people using VPNs or multiple accounts (unless it's done for obnoxious reasons, like getting around chat mutes), so there is nothing shady or to "catch". It really makes no difference to the casino or investors if you create a new account each time you play, or use the same account.

[omonuyak]

So you are trying to say that Daniel does not notice about the hack or he is letting the hack to make investors lose their investment money? Sorry for asking, but I dont get the idea of this topic since there is no solid evidences to be called as scam/hack. I believe Daniel is very trusted person in this community so I dont think he is saying the truth that there is no suspicious thing from mentioned bustabit's users.

Yeah me too, seems like just a post about how similar two or more accounts (clearly way too many) have the same betting strategy. How is that indicative of hack? But yeah, if you consider having a VPN and creating multiple user accounts and hacking the system into believing that there are multiple users playing then yeah, you could call that a hack.

However, there is no intention or a little reward for site admins to catch these shady accounts. After all, they bring activity, which is good for attracting new users.

Maybe the owner should put a price to those that will research and find out all these manipulators. With the evidence, @op was able to provide it is proved that all these users he has mentioned are manipulating the gambling system to enrich themselves. Bustabit is one of the gaming and gambling system with trusted owner and I will advise that he should faceout all this scammers and hackers.

[Haunebu]

In my opinion, I am pretty confident that Bustabit is in the green here and it was simply a smart hack executed by the hacker who is trying to make more money by selling his Bustabit script.

The guy lost 28 freaking BTC which basically cancelled out his previous wins which explains that he was over-confident and greedy and just wanted more and more. He just dug a hole for himself by trying to exploit in the same manner again and again.