Altilly Exchange FAKE Refunds, Possible Exit Scam

[ph4nt0m]

Altilly was hacked in late December, 2020. I don't know what exactly happened there. The ops said it was a hack and all exchange data including wallets were deleted. I didn't see a police report or forensic analysis or whatever. I didn't really buy what the ops said, but they promised to refund everyone, so okay. I filled the refund form like everyone else. It's a year after the hack now, they finish processing these forms and the real fun begins. Looks like they are not going to refund me at all.

Here's how stuff worked on this exchange. Every user got a deposit address. Once a deposit cleared, a script transferred it automatically to their hot wallet which was used to fund withdrawals. Looks like they didn't have cold storage and didn't even have private key backups of that hot wallet (WTF really?).

Back to my case. I had 529k Phoenixcoin (PXC) deposited there. That was like 0.2 BTC at the hack time. Mostly mined coins, so there were 1118 deposits. Sure thing I didn't keep all those deposit confirmation emails in my mailbox once the deposits were confirmed. Why should I? Now these exchange ops say they are not going to refund me anything without all those emails. How convenient, huh? I still have access to my mining wallets, told them my deposit address, even told them their main hot wallet address in case they couldn't figure it out. BTW there are 6.6 million PXC stuck, it's like 7% of the total supply.

I bet no one else claimed my deposit address, but I even offered them to sign a message with privkeys of my mining addresses to prove they're mine. Nope, they rejected. Must be too complicated for them. Show the emails or piss off. Now it sounds like a SCAM.

[coinman76]

I confirm the same situation.
They also refused to return (refund) my PXC and several other supposedly unsaved assets. I spent a lot of time negotiating with Charles Naughton to resolve the issue amicably, but they are not going to return anything, demanding a YEAR LATER ONLY screenshots of email deposits as proof, knowing that practically no one keeps them. For example, I have Gmail (messages that are in the Trash for more than 30 days will be automatically deleted). They simply decided to pass on all the losses from the hack to the users of the unsaved assets. While there is no evidence that this was a hack, it may have been a planned exit scam.
I am sure that there are many such users, to whom Altilly is not going to refund anything, since there were a lot of "unsaved assets".

It is sad. I also don't really believe that I can get my coins back from Cryptopia. There, in total, over 20M PXC are stuck. At this rate, PXC will soon become a very scarce asset)) I want to once again remind everyone about the basic rule of the crypto world “Not your keys, not your coins”.

[noorman0]

If Altilly has been acquired by Qredit, there's nothing wrong with bothering them with claims. Looks like their site is still active. https://www.qredit.io/altilly

Here's how stuff worked on this exchange. Every user got a deposit address. Once a deposit cleared, a script transferred it automatically to their hot wallet which was used to fund withdrawals. Looks like they didn't have cold storage and didn't even have private key backups of that hot wallet (WTF really?).

Do you mean they use disposable deposit addresses? I'm just reassuring that they won't store every new deposit address of every user (especially if it applies to all coins) because that's a huge database unless it ends up burning. That's why they will deny ownership signed message verification because it's definitely useless. They failed at this.

[coinman76]

Here's how stuff worked on this exchange. Every user got a deposit address. Once a deposit cleared, a script transferred it automatically to their hot wallet which was used to fund withdrawals. Looks like they didn't have cold storage and didn't even have private key backups of that hot wallet (WTF really?).

Do you mean they use disposable deposit addresses? I'm just reassuring that they won't store every new deposit address of every user (especially if it applies to all coins) because that's a huge database unless it ends up burning. That's why they will deny ownership signed message verification because it's definitely useless. They failed at this.

no, you misunderstood. Each user was assigned one permanent address for deposits, and then all the coins from these user addresses were sent to a common wallet, where they were all stored. Therefore, it is not difficult to find out who made deposits and the total amount of each of the coins, but Altilli decided to blame all the losses from the hack on users or this is another exit scam.

[ph4nt0m]

Yeah, it's actually easy to find out who deposited how much. Every user had a single deposit address for every coin listed there.

Cryptopia was also hacked and they lost their DB, too, but you could actually reason with the liquidators and prove ownership manually. These Altilly guys just don't listen to common sense. Less they pay out, more they save for themselves.

[HodlerCompany]

Hello, this is Charles

Due to the loss of our database to the hacker, we have absolutely no way of showing who owned what wallet address without the deposit confirmation emails.
These emails contained your username your, deposit address, the amount of the deposit and the TX ID.

We sent out these emails for any deposit that was made and due to the amount of people trying to claim deposits that did not belong to them by simply grabbing
a tx id off of an explorer that showed an address and claiming it was theirs we had to do something to ensure we were not giving refunds to fake claims.



I will approve any refund however if you can provide me your deposit address, that it is an altilly address and some sort real proof that it belongs to you. 

We have absolutely no intentions of trying to keep anyone from a refund. We just need to know beyond doubt that it is legitimate.

If you are able to provide the above then please by all means reply back to your tickets and ask for me personally.

Charles aka Chuck
Altilly Customer Service

[holydarkness]

Two things that I failed to understand:

1. You guys clear your inbox? Why? You use that email address both for personal and crypto so you need to keep them clean? It's personal preference though, so I can't comment further, just curious why bother cleaning your inbox.

2. Not even 1 tx proof, or screenshot or anything, left in your possession? Alltily indeed asked a deposit confirmation email, but the way I see it, that's not necessarily all 1,118 deposits. They just ask for an email showing that the address --a static, non-changing address that they dedicate for you-- is yours. One is enough.

If I may add a third one, is the PhoenixCoin platform has a fund history? Like a proof showing a token successfully mined or moved somewhere? If they have, maybe you can use that.


As for HodlerCompany, would a screenshot of tx history from the sender side --suppose there is any-- sufficient? What about a signed message from the sender address like what ph4nt0m had tried? It's a valid ownership proofing method that's even acknowledged by this forum. If your aim is just to have a proof that some address is belonged to someone, I think thats a proof of ownership enough


P.s.: oh, and last, coinman76 stop spamming

[ph4nt0m]

Hello, this is Charles

Due to the loss of our database to the hacker, we have absolutely no way of showing who owned what wallet address without the deposit confirmation emails.
These emails contained your username your, deposit address, the amount of the deposit and the TX ID.

Okay Charles, do you realize there's no reasonable way I could make 1118 screenshots of emails even if I had those? It takes days and nights.

Usernames and emails are largely irrelevant in crypto world. Where you should start is your main hot wallet address where all deposits eventually ended and all withdrawals came from. It was only one for most coins listed on your exchange. Doesn't take much chain analysis to locate it. Then you compile a list of addresses which funded it. Every such address belongs to one user of your exchange. You make another list of external addresses which were actually used to send coins to your exchange, one list per user. All of it can be scripted. Every user has to prove ownership of his addresses. The universal way of doing it is by signing a message like "User XXX email YYY claims address ZZZ used for Altilly deposits" with his private key. You verify it with the public key, match deposit tx's and amounts. That's all.

[ph4nt0m]

Two things that I failed to understand:

1. You guys clear your inbox? Why? You use that email address both for personal and crypto so you need to keep them clean? It's personal preference though, so I can't comment further, just curious why bother cleaning your inbox.

2. Not even 1 tx proof, or screenshot or anything, left in your possession? Alltily indeed asked a deposit confirmation email, but the way I see it, that's not necessarily all 1,118 deposits. They just ask for an email showing that the address --a static, non-changing address that they dedicate for you-- is yours. One is enough.

If I may add a third one, is the PhoenixCoin platform has a fund history? Like a proof showing a token successfully mined or moved somewhere? If they have, maybe you can use that.

1. Yep, I keep it tight. Never felt like I need to keep every single deposit, withdrawal, login email.

2. There could be some left in trash, but they were long gone by the time when Altilly announced those emails were must have.

3. PXC is a Bitcoin fork made in spring of 2013. Probably one of the first 20 coins ever made. Sure there's a working wallet, block explorer, etc.

[coinman76]

Two things that I failed to understand:

1. You guys clear your inbox? Why? You use that email address both for personal and crypto so you need to keep them clean? It's personal preference though, so I can't comment further, just curious why bother cleaning your inbox.

2. Not even 1 tx proof, or screenshot or anything, left in your possession? Alltily indeed asked a deposit confirmation email, but the way I see it, that's not necessarily all 1,118 deposits. They just ask for an email showing that the address --a static, non-changing address that they dedicate for you-- is yours. One is enough.

If I may add a third one, is the PhoenixCoin platform has a fund history? Like a proof showing a token successfully mined or moved somewhere? If they have, maybe you can use that.


As for HodlerCompany, would a screenshot of tx history from the sender side --suppose there is any-- sufficient? What about a signed message from the sender address like what ph4nt0m had tried? It's a valid ownership proofing method that's even acknowledged by this forum. If your aim is just to have a proof that some address is belonged to someone, I think thats a proof of ownership enough


P.s.: oh, and last, coinman76 stop spamming

1) I always keep my inbox clean and constantly delete old emails. I have a maximum of 5 important emails in my inbox. I have such a habit, I like cleanliness and order.

2)see last post by ph4nt0m. This is the only and correct solution for both parties, but Altilly stubbornly offered only 1 type of evidence in the form of screenshots, as they knew that the vast majority would not be able to provide them and it would be possible not to make returns. Altilly does not want to agree to the option proposed by ph4nt0m, as this will set a precedent and thousands of deceived users who have been denied refunds by Altilly will demand them. It is very good that this situation has come up for public discussion and now it will not be possible to quietly hush up the situation.

[holydarkness]

If I may add a third one, is the PhoenixCoin platform has a fund history? Like a proof showing a token successfully mined or moved somewhere? If they have, maybe you can use that.

3. PXC is a Bitcoin fork made in spring of 2013. Probably one of the first 20 coins ever made. Sure there's a working wallet, block explorer, etc.

No, I mean do you have a transaction record within the wallet itself? I looked at PhoenixCoin's website and learned that they have a desktop wallet and I assume this is what you use. Within the wallet app, s there a tab that shows transaction history? If there's any, a screenshot of it is probably a proof enough --although signed message is also a strong one, if you ask for my personal opinion.

[coinman76]

If I may add a third one, is the PhoenixCoin platform has a fund history? Like a proof showing a token successfully mined or moved somewhere? If they have, maybe you can use that.

3. PXC is a Bitcoin fork made in spring of 2013. Probably one of the first 20 coins ever made. Sure there's a working wallet, block explorer, etc.

No, I mean do you have a transaction record within the wallet itself? I looked at PhoenixCoin's website and learned that they have a desktop wallet and I assume this is what you use. Within the wallet app, s there a tab that shows transaction history? If there's any, a screenshot of it is probably a proof enough --although signed message is also a strong one, if you ask for my personal opinion.

of course there is and I provided screenshots from the wallet, but everything was rejected. ONLY screenshots of deposits are suitable.

[ph4nt0m]

If I may add a third one, is the PhoenixCoin platform has a fund history? Like a proof showing a token successfully mined or moved somewhere? If they have, maybe you can use that.

3. PXC is a Bitcoin fork made in spring of 2013. Probably one of the first 20 coins ever made. Sure there's a working wallet, block explorer, etc.

No, I mean do you have a transaction record within the wallet itself? I looked at PhoenixCoin's website and learned that they have a desktop wallet and I assume this is what you use. Within the wallet app, s there a tab that shows transaction history? If there's any, a screenshot of it is probably a proof enough --although signed message is also a strong one, if you ask for my personal opinion.

It is, but wallet screenshots don't actually prove anything. Import any address as watch-only and it will look like you own it. I mean the complete transaction history will be there. However no private key, nothing can be spent.

[Coin_trader]

Hello, this is Charles

Due to the loss of our database to the hacker, we have absolutely no way of showing who owned what wallet address without the deposit confirmation emails.
These emails contained your username your, deposit address, the amount of the deposit and the TX ID.

We sent out these emails for any deposit that was made and due to the amount of people trying to claim deposits that did not belong to them by simply grabbing
a tx id off of an explorer that showed an address and claiming it was theirs we had to do something to ensure we were not giving refunds to fake claims.



I will approve any refund however if you can provide me your deposit address, that it is an altilly address and some sort real proof that it belongs to you. 

We have absolutely no intentions of trying to keep anyone from a refund. We just need to know beyond doubt that it is legitimate.

If you are able to provide the above then please by all means reply back to your tickets and ask for me personally.

Charles aka Chuck
Altilly Customer Service

If your database is completely wipeout than how can you verify if the user screenshot is legit or not? Screenshot of previous deposit is very easy to photoshop and remove any trace of edit. You can't verify if the user is telling the truth if you don't have any blockchain records that will prove that the transaction is really happened.

Claiming you don't have backup to your database is absurd. This only proves how incompetent your developer is by completely wiping out your database and leave you empty handed. This is a bullshit excuse for not refunding customer.

[HodlerCompany]

Screenshots can be easily manipulated this is correct. That is why we only accept them for the deposit confirmation emails.

There is information in those emails that will tell me if the screenshot has been manipulated.  Which information it is I will not divulge
or scammers will know how to screw us.

So let me summarize what you are saying.

You dont have any solid proof that ever had assets on altilly but you want a refund?   Not even one deposit confirmation email?


Charles

[noorman0]

You dont have any solid proof that ever had assets on altilly but you want a refund?   Not even one deposit confirmation email?

Blockchain has proof that even you or the scammer can't change anything. If the funds are successfully sent to your hot wallet, then it is proof and you can't deny it. Very strange, I've never even seen a reputable exchange use this method.
The recovery method you requested is a waste of time for the real owner of the funds. Even people new to crypto know that blockchain verification is more credible than screenshots. Does your team not have competent resources to analyze blockchain transactions?

If you insist on generalizing claim terms like that, your problems will never go away at least refunding the user who can sign the address.

[HodlerCompany]

You dont have any solid proof that ever had assets on altilly but you want a refund?   Not even one deposit confirmation email?

Blockchain has proof that even you or the scammer can't change anything. If the funds are successfully sent to your hot wallet, then it is proof and you can't deny it. Very strange, I've never even seen a reputable exchange use this method.
The recovery method you requested is a waste of time for the real owner of the funds. Even people new to crypto know that blockchain verification is more credible than screenshots. Does your team not have competent resources to analyze blockchain transactions?

If you insist on generalizing claim terms like that, your problems will never go away at least refunding the user who can sign the address.

Blockchain does not provide proof that you own the address it was sent to. I will try to get more details on the signatures. 

[coinman76]

You dont have any solid proof that ever had assets on altilly but you want a refund?   Not even one deposit confirmation email?

Blockchain has proof that even you or the scammer can't change anything. If the funds are successfully sent to your hot wallet, then it is proof and you can't deny it. Very strange, I've never even seen a reputable exchange use this method.
The recovery method you requested is a waste of time for the real owner of the funds. Even people new to crypto know that blockchain verification is more credible than screenshots. Does your team not have competent resources to analyze blockchain transactions?

If you insist on generalizing claim terms like that, your problems will never go away at least refunding the user who can sign the address.

Blockchain does not provide proof that you own the address it was sent to. I will try to get more details on the signatures.  I myself am not a blockchain guru.
I am a customer service manager.

Well, if you are not competent in this matter, then why are you doing this? Invite someone who understands this, if any. Only it seems to me that your entire so-called team consists of 2 people - you Charles and Nayiem. Well, the rest are secondary representatives (admins, moderators, etc.), who do not play any role.

[HodlerCompany]

You dont have any solid proof that ever had assets on altilly but you want a refund?   Not even one deposit confirmation email?

Blockchain has proof that even you or the scammer can't change anything. If the funds are successfully sent to your hot wallet, then it is proof and you can't deny it. Very strange, I've never even seen a reputable exchange use this method.
The recovery method you requested is a waste of time for the real owner of the funds. Even people new to crypto know that blockchain verification is more credible than screenshots. Does your team not have competent resources to analyze blockchain transactions?

If you insist on generalizing claim terms like that, your problems will never go away at least refunding the user who can sign the address.

Blockchain does not provide proof that you own the address it was sent to. I will try to get more details on the signatures.  I myself am not a blockchain guru.
I am a customer service manager.

Well, if you are not competent in this matter, then why are you doing this? Invite someone who understands this, if any. Only it seems to me that your entire so-called team consists of 2 people - you Charles and Nayiem. Well, the rest are secondary representatives (admins, moderators, etc.), who do not play any role.

After the hack occured most of the rest of the team moved on.  Myself and nayiem are doing the best we can to refund users. 

[ph4nt0m]

So let me summarize what you are saying.

You dont have any solid proof that ever had assets on altilly but you want a refund?   Not even one deposit confirmation email?


Charles

They were all trashed and gone by the time you announced your refund policy. Maybe you invite Nayiem to the conversation as he seems to be the tech guy behind Altilly?