[Warning] Be aware of Scammer (Black mailer) Startup casinos should be aware of

[naim027]

Hi guys, I am naim027 and I work with a casino for almost two years now. The casino name is Paradice.in
Not that popular or famous. But This casino cares about reputation. You may know a few months earlier a guy creates a scam accusation against Paradice because paradise canceled his $7000 withdrawal which was made from Faucet. After that, our management changed the faucet rules and paid that guy in full which he confirmed in Paradice ANN

Back to the main topic: Recently a bunch of newbies comes to Paradice ANN and made complaints without proof that Paradice is a scam casino and they don't pay. So, I asked their usernames and surprisingly found a scammer who is still trying to ruin the casino's reputation and trying to blackmail us.

Scammer profile link: gero2021
Type two Flag Created: Flag here

The story begins from here. He claims that Paradice canceled his withdrawals and banned him. So I asked his username. And found something interesting. Paradise was started back at the end of 2019. This guy found some loophole in our system (the player was able to make bets even he had a negative balance) and made 9 BTC 24 ETH and 5 LTC in a few hours without making a deposit. He withdrew 2 BTC in 5 Transactions. After that we caught him and we rejected his withdrawal and fixed the glitches. After we blocked him, he created 6 more alts to execute the same process to steal more money. Since it was the beginning of Paradice's journey, we may have had some issues and every platform may have too. After that, we were unable to contact him and we never knew who was that. Almost two years have been passed and this guy shows up with claims that Paradice is a scam casino they don't pay. This guy was able to steal 2 BTC from a Startup casino using the advantage of glitches and back again with complaints and trying to blackmail the casino again.

I would like to quote some of his and mine posts from the ANN thread.

Wow! Finally, I meet you. I am surprised that you want to confess yourself. You are the guy who found a loophole in our system and managed to withdraw 2 BTC which was USD 23329 at that time. How you will explain that you never deposited a Sato shi but you managed to withdraw 2 BTC from Paradice. After we caught you, You have created 6 more accounts (1.caza 2.termotanque 3.termo 4.Victor555 5.drass 6.sssssssss)to execute the same process that you used to withdraw 2 BTC without making any deposit and exploit our system. So, you stole 2 BTC ($23329) from Paradice. I would like to request you to return our 2 BTC or $23329 in BTC.

I am surprised that you were not satisfied with that and still you want to get unblocked and try to exploit it again. The last thing is, You making complaints here.

naim027
Moderator

Seems they are not going to reply anymore. If they reply, they will post shit (I except). Coz, their accusations don't have any proof. Even, a scammer trying to ruin this casino's reputation. He stole 2 BTC in 5 transactions back on August 05, 2020. After that, Our administration noticed that he found a loophole in our system and banned his account. He immediately creates 6 more accounts to do the same process but our system prevents his further attempt. He didn't deposit a single penny and he stole 2 BTC, Still he saying we canceled his withdrawals. Could you guys ask him to post a screenshot of his canceled withdrawals? So that you guys can see the amount? And ask him how he earned 9 BTC, 24 ETH, 5 LTC in a few hours without making a deposit? Unfortunately, we noticed he did shit and prevents his further attempts.

Note: I am waiting for the administration's permission to create a scam alert thread against them so every casino can be aware of them.

naim027
Moderator of Paradice

As you well recognize, I won those amounts without any deposit. I did it from the faucet. After I started making withdrawals they blocked my account and I couldn't withdraw the rest of my money.

I did not exploit any bug or do anything illegal, nowhere in their T&Cs does it say that negative bets cannot be made, and the casino allowed them to be made all the time, so it was nothing illegal.

please send me my money

This thread is for Start-Up casinos to be aware of. Before launching your platform, launch it with a test net and offer some bug bounty. So you may be able to fix all the possible bugs/glitches.

Note: I did not submit any proof of withdrawals of this user or proof of his alts. This s is a public forum, so we don't want to share information here. But, If any Reputed member like LoyceV or Ratimov or Moderator asks for proofs, I can provide them in PM.

[LoyceV]

I did not exploit any bug or do anything illegal, nowhere in their T&Cs does it say that negative bets cannot be made, and the casino allowed them to be made all the time, so it was nothing illegal.

How did this work? The user's balance was 0BTC, he bets -1BTC, loses, and gets 1BTC profit? Lol, that's a terrible bug if it worked that way!

[examplens]

OP, I support your flag ^{for now} I think it takes some more of the DT members to give support to be active.
I guess now It's been a long time, but OP do you have any saved logs of what exactly this user do on your ^{Paradice casino} platform?
whether it is possible that he claimed from the faucet and made such large amounts?

I did not exploit any bug or do anything illegal, nowhere in their T&Cs does it say that negative bets cannot be made, and the casino allowed them to be made all the time, so it was nothing illegal.

How did this work? The user's balance was 0BTC, he bets -1BTC, loses, and gets 1BTC profit? Lol, that's a terrible bug if it worked that way!

it's obviously, multiplying negative numbers  on the mathematical side, this is correct.

[naim027]

I did not exploit any bug or do anything illegal, nowhere in their T&Cs does it say that negative bets cannot be made, and the casino allowed them to be made all the time, so it was nothing illegal.

How did this work? The user's balance was 0BTC, he bets -1BTC, loses, and gets 1BTC profit? Lol, that's a terrible bug if it worked that way!

True! I was not working with them back then. I guess that bug was not for everyone but somehow he found a loophole. But he claims that he was able to bet in negative. Yes!, that was a terrible bug.

OP, I support your flag ^{for now} I think it takes some more of the DT members to give support to be active.
I guess now It's been a long time, but OP do you have any saved logs of what exactly this user does on your ^{Paradice casino} platform?
whether it is possible that he claimed from the faucet and made such large amounts?

Thank you for supporting my flag. Yes, He already confessed that he did it with a faucet amount. But, somehow he found a loophole and he was able to bet even he had a negative balance. I don't want to show logs in public since he already confessed himself. So, I guess I don't have to submit unless you guys ask me.

Is it the same loophole they are trying to cheat on? Why paradice don't bother to fix the bug?
Either way, you must be thankful to them as they have helped to find out the issue; there could be an even bigger loss.

I was also surprised by RaptarX's posts that he thinks we should be thankful to this scammer/hacker for stealing 2 BTC from our platform.

[aioc]

Is it the same loophole they are trying to cheat on? Why paradice don't bother to fix the bug?
Either way, you must be thankful to them as they have helped to find out the issue; there could be an even bigger loss.

I was also surprised by RaptarX's posts that he thinks we should be thankful to this scammer/hacker for stealing 2 BTC from our platform.

Of course, we don't owe anything to the scammer/ hacker but still, it will eventually drain the casino if the bug is still open and not fixed, it's the price you have to pay if you have security loopholes and you don't do anything about it and you will not find this out if not for that hacker, it's like thanks but no thanks scenario.

[holydarkness]

First thing first, I didn't try to prove that gero2021 is not the bad guy here, he cheated, we can agree on that. But i think there's more to this than meets the eye. So, (un)surprisingly, I will try to take the role of the devil's advocate.

These are what we knows from the shared information and small date check are as follows:

• Paradice first launched their ann thread in 2 December 2019
• Somewhere between initial launch and 23 July 2020 they do site updates and tests new features on testnet
• gero2021 or also known as Caza played Paradice on 5 August 2020 with faucets and soon discovered a bug that allows him to bet negative, where double negative brings positive, thus 2btc withdrawn, and the rest 7btc, 24eth, and 5ltc were frozen by the admin

My questions:
1. From the beginning of the site launch up to whenever point, were there a team of beta tester?
2. If there were, do gero2021 part of this tester team?
3. Since the time of gero2021's manipulation and testnet is relatively close, is there any prove whether gero2021 played on testnet or on mainnet?

[naim027]

My questions:
1. From the beginning of the site launch up to whenever point, was there a team of beta testers?

No, There was no beta tester team. But, after this. Paradice be awarded and they do test before launching new programs.

2. If there were, do gero2021 part of this tester team?

We never had beta tester team. Still, we don't hire beta tester from outside of the team. We do test by our staff team. And gero2021 is not our staff.

3. Since the time of gero2021's manipulation and testnet is relatively close, is there any proof whether gero2021 played on testnet or mainnet?

As I already told you. We never had the testnet and beta tester team back then. But, we have a secured testnet now. But, only Paradise staff can access the test net. Yes, we have proof. But, we don't want to show it here for security reasons. If any moderators or LoyceV or Ratimov ask for it. I can provide it via PM.

[holydarkness]

My questions:
1. From the beginning of the site launch up to whenever point, was there a team of beta testers?

No, There was no beta tester team. But, after this. Paradice be awarded and they do test before launching new programs.

2. If there were, do gero2021 part of this tester team?

We never had beta tester team. Still, we don't hire beta tester from outside of the team. We do test by our staff team. And gero2021 is not our staff.

3. Since the time of gero2021's manipulation and testnet is relatively close, is there any proof whether gero2021 played on testnet or mainnet?

As I already told you. We never had the testnet and beta tester team back then. But, we have a secured testnet now. But, only Paradise staff can access the test net. Yes, we have proof. But, we don't want to show it here for security reasons. If any moderators or LoyceV or Ratimov ask for it. I can provide it via PM.

Well, I am asking because if the scenario is a testnet, then gero2021 is clearly cheating, as he breached the agreement between the test member and dev by manipulating the loophole instead of reporting it. But now, based on your answer which can't stress enough that gero2021 is not a test member, and that he's playing on mainnet, it is became glaringly obvious that the case was like what RaptarX and aioc said. You had a bug in your system, which is completely your fault, and thanks to the cheater you found and patched it.

Did you owe him the rest of the fund? No, i don't think so.
Did he have to return the 2btc? IMO, no. It's his reward for finding a loophole and the consequence you have to pay for not screening your program thoroughly enough.
Did he deserve a type-2 flag? Again, IMO, no. A red trust maybe, but not a flag, as he didn't breach any contract. He's not a member of test program under contract, nor your TnC --as he stated-- specifies that betting negative is not allowed.

[naim027]

Did you owe him the rest of the fund? No, I don't think so.
Did he have to return the 2btc? IMO, no. It's his reward for finding a loophole and the consequence you have to pay for not screening your program thoroughly enough.
Did he deserve a type-2 flag? Again, IMO, no. A red trust maybe, but not a flag, as he didn't breach any contract. He's not a member of the test program under contract, nor your TnC --as he stated-- specifies that betting negative is not allowed.

Oh really? Based on your opinion. If you go to a shop and see no one there is even no shopkeeper. would you grab anything you want and run away? And do you think that it's your reward and you should not return it to the shopkeeper because it's his responsibility to secure and keep eye on his shop? Should shopkeepers advertise that stealing from their shop is forbidden? If he doesn't do. That's means stealing from this shop is okay. Right? If yes, then he doesn't deserve a red trust too. He deserves to be DT-1 and he should be on everyone's trust list. I was wondering how the heck people do looting from a chain shop and who are these guys? Don't they feel it's not right? I guess I found some guys like these.

Anyways, Not just did he steal 2 BTC but also he was back again and making complaints that the casino is not paying. They blocked him. He is trying to blackmail the casino. That's why we are here with an accusation after 2 years.

[holydarkness]

Did you owe him the rest of the fund? No, I don't think so.
Did he have to return the 2btc? IMO, no. It's his reward for finding a loophole and the consequence you have to pay for not screening your program thoroughly enough.
Did he deserve a type-2 flag? Again, IMO, no. A red trust maybe, but not a flag, as he didn't breach any contract. He's not a member of the test program under contract, nor your TnC --as he stated-- specifies that betting negative is not allowed.

Oh really? Based on your opinion. If you go to a shop and see no one there is even no shopkeeper. would you grab anything you want and run away? And do you think that it's your reward and you should not return it to the shopkeeper because it's his responsibility to secure and keep eye on his shop? Should shopkeepers advertise that stealing from their shop is forbidden? If he doesn't do. That's means stealing from this shop is okay. Right? If yes, then he doesn't deserve a red trust too. He deserves to be DT-1 and he should be on everyone's trust list. I was wondering how the heck people do looting from a chain shop and who are these guys? Don't they feel it's not right? I guess I found some guys like these.

Anyways, Not just did he steal 2 BTC but also he was back again and making complaints that the casino is not paying. They blocked him. He is trying to blackmail the casino. That's why we are here with an accusation after 2 years.

My opinion doesn't match your illustration. Your illustration tries to paint the thief's morality, i.e.: should or should not someone steal when there is a chance, while my post --which even more explicitly stated on the post above it-- already acknowledge that he is cheating, my post is about responsibility.

If we have to use your illustration, do you honestly think the shopkeeper is completely not at fault and could not be held responsible to certain degree because he leave his store unattended and some stuff is lost? "it's his responsibility to secure and keep eye on his shop?" uhh, yes? Doesn't it a shopkeeper's job to keep the shop? It's in the name, "shop-keeper".

Likewise, it's the dev and security team's job to make sure their platform is secure and bug free. Thus, a beta test and test net and security update. One thing that zi amnnot shy away to say, if you need to hear them, your team is good --and lucky-- enough to notice the bad transaction when he tried to withdraw 2btc and prevented him from taking further damage. But what is done is done.

Let's revisit your thief illustration. Have you encountered a scenario where a thief return the stuff they stole because he's asked to? I haven't. Thus, my three conclusion as above post:

1. You have no responsibility to give him the rest of his "money" because he's blatantly cheating.
2. He doesn't have to return the 2btc he stole.... which seems angered you, so if I may rephrase to better suit your situation, the atatement I said before can also be read as, "team shouldn't expect him to return the money, it'll be easier to consider it as a dead-end, because there's no chance he'll return it."
3. The type-2 flag also didn't match the situation. Type-2 flag is for a breach in an implied contract. You have no contract with him and he didn't break an TnC on your site. He stole. If you want to judge this user better and fairly, a red trust and type-1 flag --or is that yellow flag is type-3?-- suits better.

Besides, let's say we support the flag and it's activated, what benefit can be achieved from raising type-2 flag to his account? His account is a newbie account created 5 days ago. If it's tagged with flag, all he need to do --which I am sure he'll very likely do-- is just disposes off the account. The point is, you're pursuing a wrong path. If you want to contribute more to the community, the casino community to be specific, and punishes his for his action, it'll be better to share something more permanent and personal like his IP address --not a techie here, so I'm not sure if it's something permanent or we can change them easily like telegram username-- so that all other casino could put him on their ban list. Not sure if it's allowed by the forum to write them here, but I very faguely remember that some people shared a cheater's IP. And suppose it is not allowed by the forum rules, there's a specific board on this forum that allows personal information to be shared, it'll be a safer bet, if you really want to contribute to the gambling society by ridding a cheater.

Now, that's all about return, payment, and flag-related-cheating. As for the blackmailing, it should be another situation. What's his blackmail looks like?

[naim027]

1. You have no responsibility to give him the rest of his "money" because he's blatantly cheating.
2. He doesn't have to return the 2btc he stole.... which seems angered you, so if I may rephrase to better suit your situation, the atatement I said before can also be read as, "team shouldn't expect him to return the money, it'll be easier to consider it as a dead-end, because there's no chance he'll return it."
3. The type-2 flag also didn't match the situation. Type-2 flag is for a breach in an implied contract. You have no contract with him and he didn't break an TnC on your site. He stole. If you want to judge this user better and fairly, a red trust and type-1 flag --or is that yellow flag is type-3?-- suits better.

Well, Why are you twisting my words? I didn't create this thread to get a refund of 2 BTC. This thread is not about getting a 2 BTC refund. Even though I asked him to return the 2 BTC, I don't expect he will return it. This thread is about to aware startup casinos. Even you also agree that he is cheating, Still, Your words seem you keep supporting him for what he did. Type --2 Flag said, "This user violated a casual or implied agreement with me, resulting in damages". Do you think we should write "Stealing from this casino is forbidden in Our TnC?

Okay. I don't want to create chaos here. Everyone has their own mind setup and different opinion. If you believe stealing from a casino is right and we cannot ask him to return. Don't support the flag. it's over.

[LoyceV]

I don't think you're allowed to create this Flag:

Type --2 Flag said, "This user violated a casual or implied agreement with me, resulting in damages".

This statement is incorrect considering this:

I was not working with them back then.

This means you're not a victim, which means you're only allowed to create a type 1 (Newbie warning) Flag.
See:

Creating or supporting a scammer flag is actively affirming a set of pretty clear fact-statements.

[naim027]

I don't think you're allowed to create this Flag:

Type --2 Flag said, "This user violated a casual or implied agreement with me, resulting in damages".

This statement is incorrect considering this:

I was not working with them back then.

This means you're not a victim, which means you're only allowed to create a type 1 (Newbie warning) Flag.
See:

Creating or supporting a scammer flag is actively affirming a set of pretty clear fact-statements.

I am a Staff of the Casino. If I cannot create the flag or casino staff cannot create the flag, Then who can create the flag? Owner only? I guess he doesn't have the time to create a flag. We staff getting paid to work for them.

In my opinion, any Agent or Staff of the Company should be able to create a Flag. Company Owners don't have that much time to handle everything. That's why the Company hired us to do work for them. If you still think, Staff is not allowed to create a type-2 flag. Please explain why?

[khaled0111]

Do you think we should write "Stealing from this casino is forbidden in Our TnC?

No, you don't have to do that. There is already this in Paradice.in rules:

5.1. PERSONAL APPLICATION. The User is entitled to use the Service only for the private purposes. The User is allowed to use the web-site for his personal entertainment and does not have the right to create multiple accounts or use the web-site for conspiracies and/or misuse of the service.

Not sure if the bolded part existed prior to the incident or was added later, though.
However you can make it more explicit by stating that exploiting bugs or vulnerabilities is forbidden.

I don't think you're allowed to create this Flag:

Type --2 Flag said, "This user violated a casual or implied agreement with me, resulting in damages".

Being their representative in this forum, I believe he can create a type 2 flag on their behalf. Just my opinion

[LoyceV]

who can create the flag?

The victim.

Owner only? I guess he doesn't have the time to create a flag. We staff getting paid to work for them.

It may have worked if you worked there at the time of the incident, but I don't think you're a victim of something that happened before you joined.

In my opinion, any Agent or Staff of the Company should be able to create a Flag.

The rules of the Trust flags seem to disagree. This would be a good question to post in that thread, see if theymos answers it.

Please explain why?

I already did

[naim027]

I don't think you're allowed to create this Flag:

Type --2 Flag said, "This user violated a casual or implied agreement with me, resulting in damages".

As their representative on the forum, I believe he can create a type 2 flag on their behalf. Just my opinion

Yes. You are Right. On LoyceV Suggestions I asked theymos on that thread and theymos replied me this.

Hey, theymos. I have a question. It seems Trust Flags Rules say that only a Victim can create a Flag. But, What about when it comes to a Company? For example casino. If Casino is the Victim. Who is able to create a Flag against scammers? Should Casino owners create a Flag because he owns the casino and he is the actual victim? If yes, I have something to tell you about this.

If an organization is the victim, then anyone authorized by the organization to act on the organization's behalf in these sorts of things can create the flag.

What's his blackmail looks like?

If you check his profile. All of his 5 posts were made on the paradice thread. That's mean this account was created to black main Paradice. I assume this guy has another Good ranked Bitcointalk account. And he doesn't want to lose his reputation or don't want to get a Red Trust. He created this account to ruin Paradice's Reputation and Intentionally gain something from Paradice.

[holydarkness]

[...]

Okay. I don't want to create chaos here. Everyone has their own mind setup and different opinion. If you believe stealing from a casino is right and we cannot ask him to return. Don't support the flag. it's over.

It looks like we are started with the wrong footing here. Just to be clear, again, NO, I didn't believe what he did is right, as I multiple times have stated, he cheated. If it worth something, I've tagged him with negative trust, although it wouldn't bear significant effect to the community, just like how it'll be with your flag.

The point that I want to propose to you is that the path you're chasing --namely tagging gero2021 with type-2 flag-- is rather useless, just like what you state here, and if we revisited theymos's original plan for flags,

[...] I assume this guy has another Good ranked Bitcointalk account. And he doesn't want to lose his reputation or don't want to get a Red Trust. He created this account to ruin Paradice's Reputation and Intentionally gain something from Paradice.

I think that several of the problems with Trust were because three different goals were being jammed into one system:
 1. Getting a general idea of someone's trade history and trustworthiness in one convenient location, sort of like reviews on sites like EBay.
 2. Warning newbies/guests who don't know how to research properly about high-risk people.
 3. Deterring scams by creating a cost to scamming (ie. you'll "lose" a veteran account).
 
To improve this, I've split up these use-cases:

Use-case #1 is the old trust system, but I made the descriptions on the rating types a bit more general and removed the concept of a trust score. The numbers are now "distinct positive raters / distinct neutral raters / distinct negative raters". You should give these ratings for anything which you think would impact someone's willingness to trade with the person, but you should not use trust ratings to attack a person's opinions or otherwise talk about things which would not be relevant to reasonable prospective traders.

Use-cases 2 and 3 will be handled by a new system of flags. You can create a flag using a link on a person's trust page [...]

Like I said previously and what you've acknowledged above, the account is a newly created account, a puppet account, alt-account, whatever you call them. It is lacking the "cost" that theymos said on point number 3.

Suppose that your flag is active, it'll bear null impact to the betterment of gambling community, because the tagged account has no value to lose. They'll just create new account --on this forum pr on other gambling sites-- if they feel they need to. It'll be a different case, though, if you can flush the main account which probably have a higher rank, or --like I said multiple times-- share something more permanent and techhie that other casinos could put him umder the ban list. IP address? MAC? Again, I'm not a tech savvy, but I've stumbled several times on vases where IP is used to identify someone and tie/negate thr scammes alt accounts.

[naim027]

~snip~

That makes much more sense. But, I guess you understand the purpose of this thread. I can share his detailed information but this thread doesn't suitable for sharing personal information. You can see this thread as an awareness for the startup casinos and for the people who are thinking to do their startup. About Flag, At least we the Paradice team want to strongly prevent his attempts of cheating. If I can figure out his original BitcoinTalk account shortly. We will create a flag. But, before that, we have to prove that this account is connected with that. But, I guess it has less than a 1% chance that he will give us that kind of chance. So far, we have his newbie account and have the right to create a flag against his account. No matter if it's a new account or a Legendary account.