stolen money from games.bitcoin.com

[BrotherBoy]

Hello,

I was playing games.bitcoin.com (I was provided https link) https://games.bitcoin.com/?account_key=d35d372dde... and I sent another deposit of around 0.11 BTC and then it was
too long time to wait for confirmation and I decided to play later.

I closed the window and in about 10 hours I returned back to URL to play. I noticed that my account was "password protected" and I contacted support. After questioning me (to confirm that I'm account owner) the password protection has been disabled. And what is the surprise - my balance shows 0 BTC.

Support has told me that funds were withdrawn. I sent email to games@bitcoin.com and never received
reply.

How hacker can access my account with balance within 10 hours after I deposit funds there?

Its seems for me that hacking occured on the bitcoin.com side. Be careful as you can lose your money easily with games.bitcoin.com due to lack of security.

[adzino]

Hello,

I was playing games.bitcoin.com (I was provided https link) https://games.bitcoin.com/?account_key=d35d372dde... and I sent another deposit of around 0.11 BTC and then it was
too long time to wait for confirmation and I decided to play later.

I closed the window and in about 10 hours I returned back to URL to play. I noticed that my account was "password protected" and I contacted support. After questioning me (to confirm that I'm account owner) the password protection has been disabled. And what is the surprise - my balance shows 0 BTC.

Support has told me that funds were withdrawn. I sent email to games@bitcoin.com and never received
reply.

How hacker can access my account with balance within 10 hours after I deposit funds there?

Its seems for me that hacking occurred on the bitcoin.com side. Be careful as you can lose your money easily with games.bitcoin.com due to lack of security.

Sorry to hear about this, but why would do deposit on a site that isn't secure at all? I guess this casino (i haven't clicked on the link) does not require you to have an account in order to play and uses that account key as a way to access your account. Those casinos are not secured at all. Anyone can easily get access to your own private link and take control over your account. You should have set a password on your account before you made any deposit.
Ask the support on which address the withdrawal was made and tell them to check their IP log for any anomaly.

[BrotherBoy]

They have provided me withdrawal address, but they did not provide me IPs.

However, how its possible that someone can have access to my link if the link is generated
in browser thru https secure connection and unique identifies my account?

[ralle14]

If the hack occured on the site's side the hackers should've went for accounts with higher balance. I guess someone found a way to get a remote access, that's the only way I can imagine how they're able to get your coins since you didn't put any password or linked an email in the account

Sorry to hear about this, but why would do deposit on a site that isn't secure at all? I guess this casino (i haven't clicked on the link) does not require you to have an account in order to play and uses that account key as a way to access your account. Those casinos are not secured at all. Anyone can easily get access to your own private link and take control over your account.

The site did mention it, when you load their site a window pops up asking you to set a password and activate 2fa to secure the account but OP let his guard down.

[Pffrt]

Isn't bitcoin.com domain owned by Roger and promoting BCH? If so, I think this subdomain will not accept BTC but BCH. Is that something you are missing, OP? I have no idea about this site because I have never played this.

[sunsilk]

Isn't bitcoin.com domain owned by Roger and promoting BCH?

Yes, this is owned by Roger

If so, I think this subdomain will not accept BTC but BCH. Is that something you are missing, OP? I have no idea about this site because I have never played this.

Yeah, like much what I'm thinking. BTC on bitcoin.com = BCH so there must be something wrong during the deposit and that's why OPs deposit was withdrawn or mostly gone from their system and can't even think of any other way that somebody stole his fund from them.

[sheenshane]

You can open a topic in the Scam Accusations board if you have strong evidence against them, just like the screenshot of transactions or emails. Upon searching on the scam accusation board I found out there are two threads there that have been resolved after they were posting there.
[SOLVED] Roger Ver's Bitcoin Games - possible scam 2
Roger Ver's Bitcoin Games - possible scam - resolved.

I dont think if they are selectively scamming users but that is sad that they had poor service. Unfortunately, they are an untrustworthy gambling platform.

Isn't bitcoin.com domain owned by Roger and promoting BCH?

Yes, this is owned by Roger

Yes, that is him. But maybe that is not directly him who doing scam. It might be their staff.

[1Referee]

They have provided me withdrawal address, but they did not provide me IPs.

If it's okay with you, can you share that withdrawal address? If not that's fine too. In case the funds have been sent to an exchange, you could choose to notify the exchange in question and see how far you come, but they will very likely demand evidence of actual theft. In other words, I would pressure bitcoin dot com to release more data such as the IP's. I don't see why they will show you the withdrawal address but not the IP.

Yes, that is him. But maybe that is not directly him who doing scam. It might be their staff.

I do not like Roger, but I highly doubt that he or his staff is repsonsible for the theft. I can be completely wrong of course, but it to me looks like a classic case of a hacker having had access to OP's system and stole the funds. Or, the site has been compromised, but if that was the case there would have been more complaints on both the Bitcoin and BCash side, which isn't the case.

[Potato Chips]

Sensitive information in a URL... so outdated. They are logged and can be accessed in plain text in your web browser and worse if you have something like google acc which syncs your history across your devices (if you didn't opt-out). Lot's of ppl trying to snoop in our browsing activity so they can sell it, it could also be just a malicious browser extension

Seeing that they are giving users a warning to password-protect their account means they are aware of the security implications and yet they are doing nothing... I don't see any reason why they're still allowing these non-password protected accs to function like normal as it is basically compromising security for convenience.  

lastly, don't ever reveal any part of sensitive information. Remember the more info an attacker gets, the easier it is to succeed.