Double spending exploits in early cypto casinos <>

[bitbollo]

I remember that probably there was an issue with direct bet (One of the earliest sport bookmakers with crypto).
Their site was generating and address linked to a match/event.

Scammers (It seems) were able to send funds with negligible fees. In case of (potential) winning they add correct amount of fees or in case of lose they complete double spend.
I never have seen and official statement on this matter but they just close the activities after few years online even paying bonuses and so on...

[Potato Chips]

There is actually a big difference if the casino has no restriction on withdrawals of someone which deposit/s is unconfirmed. Imagine if a player wins with their unconfirmed transaction, and they'd be able to freely withdraw said winnings. This player could also try to double spend the same UTXO with a much higher fee so it will likely confirm first making the previous transaction invalid.

I don’t think that’s possible. Back in the early days of casinos and sportsbooks, I experienced them crediting my deposit right away as long as it was already on the blockchain. But they wouldn’t process the withdrawal unless it had at least one confirmation, which I believe is just a standard security measure.

You misunderstood. See the person I quoted saying "There is almost no difference if the gambling site does not allow withdrawals before the confirmation. In this case if the user use double spending then there will will have no benefit of the user."

Thus, the bolded bit was an example risk if a casino does not impose restriction on withdrawals of folks with unconfirmed deposits. There is a difference as you do open the platform for abuse if you don't have it, and bad actors could surely benefit.

[traderethereum]

Casino will not tell if that makes them hit badly because of that. But the casino may do something to prevent that from happening. But this makes me think that if scammers can use this hole, they will take that for their benefit and do that over and over again. I guess some casinos will credit the balance once they see the transaction is in the blockchain. But they will not allow someone to withdraw the money before the first transaction finishes. Besides that, casinos with their experiences from a long time ago will anticipate that it will happen in their casino. They will not let their system be rigged by their members so that may be a reason why casinos need to verify their members before they can process the withdrawal.

[stadus]

Casino will not tell if that makes them hit badly because of that. But the casino may do something to prevent that from happening. But this makes me think that if scammers can use this hole, they will take that for their benefit and do that over and over again. I guess some casinos will credit the balance once they see the transaction is in the blockchain. But they will not allow someone to withdraw the money before the first transaction finishes. Besides that, casinos with their experiences from a long time ago will anticipate that it will happen in their casino. They will not let their system be rigged by their members so that may be a reason why casinos need to verify their members before they can process the withdrawal.

Some casinos have already been exploited in the past, which is why they now require blockchain confirmations.. some ask for 1, others even 2.
That’s the fix they came up with to avoid getting exploited again.

As for what you said about casinos crediting deposits instantly but not allowing withdrawals until confirmed, there’s still a loophole in that setup. That’s why you rarely see it practiced today.

[kyman1]

Just wanted to bring up an interesting topic that some of you who were around during the early days of crypto gambling might remember, double spending exploits, especially during the dice era.

Back then, some casinos didn’t require any confirmation for deposits. As long as the transaction appeared on the blockchain (even unconfirmed), the account would get credited instantly. sounds convenient, right? But that’s where some smart gamblers took advantage and pulled off double spends, sending the same transaction elsewhere before it confirmed, basically reversing the original deposit.

I wasn’t that deep into it during those times and didn’t fully understand what was going on, but I’ve heard that this exploit caused real losses for some platforms. That’s probably why most casinos today require at least 1 confirmation before crediting your wallet.

question...
(1) Were there any casinos that actually got hit badly because of this?
(2)Is there any known case with a reported loss figure?

That was very cool lol, i didnt know something like that happened before. I know now these kind of mistakes are impossible but there are still bugs everywhere if you can find them, but of course it get harder and harder better and better so its a reak big problem to do something like this now. Only way i think if you do bug hunting and can really do some stuff to them otherwise I dont thinks its possible anymore

[Sanitough]

That was very cool lol, i didnt know something like that happened before. I know now these kind of mistakes are impossible but there are still bugs everywhere if you can find them, but of course it get harder and harder better and better so its a reak big problem to do something like this now. Only way i think if you do bug hunting and can really do some stuff to them otherwise I dont thinks its possible anymore

This isn’t a bug on the casino’s side, it’s on the blockchain. Sometimes transactions don’t confirm quickly because the fees are too low. It can take hours before it confirms, even if it’s already credited to the casino. Once the user increases the fee, the confirmation goes through.

But why would someone bother increasing the fee if their account is already credited and they can gamble right away? Maybe they’ll only do that later, when they win, since they can’t withdraw without the deposit being fully confirmed first.

[stompix]

~

If they don't require any confirmation or if they don't have any deposit or withdrawal option, then there is a high chance scammer may scam them by double spending. I have never used these sites, so I have no idea about them.

None of those websites are active anymore, on-chain gambling which would involve paying a fee each time you place a bet and the casino paying a fee each time they would have to pay you, plus the millions of inputs would simply be impossible to manage in the current day, even with these low fees, you would still pay 5-10$ just in fees for some bets at the end of the day.

But my question is, if anyone misuses the double-spending option, then how can they prevent being scammed?

In those days, with no confirmation deposits, no account on chain betting? You couldn't! That's why that type of casino has died!

[Iranus]

Duplicate-transaction was a real problem in the past where casinos imputed deposits before confirmation. Some companies were destroyed but the details are rare to find. The newest and most talked about exploit was Stake.com getting hacked by the north Korea's Lazarus group and getting robbed $41 million. This wasn't a duplicate transaction but still shows the flaws  of Blockchain casinos.
These occasions have made way for rigorous policies such as at a minimum one verification before imputing deposits. So yes duplicate- transaction is not a big deal now, but it has lectured as about our problems and still influences the Blockchain gambling system

[Russlenat]

The newest and most talked about exploit was Stake.com getting hacked by the north Korea's Lazarus group and getting robbed $41 million. This wasn't a duplicate transaction but still shows the flaws  of Blockchain casinos.

This should probably be in a different topic, hacks on casino funds, no matter what technique they used. The double spending problem back then could be done easily by gamblers, but it was only discovered later and casinos adjusted their systems late as well.

It’s not happening anymore since casinos now require at least 1 confirmation, and some even require 2. Everything is already in place.

Right now, we’re just gathering data on how much was lost, but so far in this thread, I haven’t seen much information. Probably because Bitcoin was still cheap at that time, so it wasn’t considered a big concern.

[shasan]

There is actually a big difference if the casino has no restriction on withdrawals of someone which deposit/s is unconfirmed. Imagine if a player wins with their unconfirmed transaction, and they'd be able to freely withdraw said winnings. This player could also try to double spend the same UTXO with a much higher fee so it will likely confirm first making the previous transaction invalid.

You are correct and I agree with you that there are too many difference to the restriction of the withdrawal and no restriction of the withdrawal. But if they restrict withdraw before the confirmation then they would not be able to scam as they can not withdraw the fund and if they deposit later then the site will catch that and will suspend the gambler.

[Kelward]

Duplicate-transaction was a real problem in the past where casinos imputed deposits before confirmation. Some companies were destroyed but the details are rare to find. The newest and most talked about exploit was Stake.com getting hacked by the north Korea's Lazarus group and getting robbed $41 million. This wasn't a duplicate transaction but still shows the flaws  of Blockchain casinos.
These occasions have made way for rigorous policies such as at a minimum one verification before imputing deposits. So yes duplicate- transaction is not a big deal now, but it has lectured as about our problems and still influences the Blockchain gambling system

I didn't know that the early casinos faced this scam by dubious gamblers I hope that there is no loopholes for such to occur again. The level of scams and hacks on the internet should a very big concern not only gamblers and casinos but everybody that clicks anything online. I know that casinos are not relenting to find ways to cover their tracks to avoid scams and hacks. But can there ever be a time when these criminals will be out out their jobs, I seriously doubt it, our securities including the casinos are in our hands, nobody can hold the internet responsible.

[leonair]

(1) Were there any casinos that actually got hit badly because of this?
(2)Is there any known case with a reported loss figure?

In fact, Bitcoin is the only one that takes a long time to confirm a block. Apart from that, other coins complete transactions very quickly, due to which when someone deposits a crypto on a casino site, it is credited to the balance immediately because the transaction is also completed quickly and there is never a chance to cancel the transaction. But in the case of Bitcoin, as far as I have seen, it takes a little longer than other chains to make a deposit. Still, they credit the balance before the block is fully confirmed. I don't know how they verify a valid transaction, but I have not seen any casino site spreading news that they face any problems for pre-credit or they have to face any kind of loss.

[shasan]

I didn't know that the early casinos faced this scam by dubious gamblers I hope that there is no loopholes for such to occur again. The level of scams and hacks on the internet should a very big concern not only gamblers and casinos but everybody that clicks anything online. I know that casinos are not relenting to find ways to cover their tracks to avoid scams and hacks. But can there ever be a time when these criminals will be out out their jobs, I seriously doubt it, our securities including the casinos are in our hands, nobody can hold the internet responsible.

I have also never heard about the scam of double-spending. But it may happen and might not be disclosed as the gambling site never disclose like this issues. If they publish, then they might have the more trap about it and it is perfect as you can see no scam accusation by any gambling site.

[Russlenat]

I didn't know that the early casinos faced this scam by dubious gamblers I hope that there is no loopholes for such to occur again. The level of scams and hacks on the internet should a very big concern not only gamblers and casinos but everybody that clicks anything online. I know that casinos are not relenting to find ways to cover their tracks to avoid scams and hacks. But can there ever be a time when these criminals will be out out their jobs, I seriously doubt it, our securities including the casinos are in our hands, nobody can hold the internet responsible.

I have also never heard about the scam of double-spending. But it may happen and might not be disclosed as the gambling site never disclose like this issues. If they publish, then they might have the more trap about it and it is perfect as you can see no scam accusation by any gambling site.

There were reports in the past of some dice sites claiming they were victims of double spending. You can find news or even forum discussions about it from back then. Probably some sites kept it private so they wouldn’t get exploited further, but eventually they made adjustments and started requiring confirmations.

GHash.IO and double-spending against BetCoin Dice
Double spending
BitBet Falls Victim To Strange Bitcoin Double-Spend Behavior

[mikel_012]

I didn't know that the early casinos faced this scam by dubious gamblers I hope that there is no loopholes for such to occur again. The level of scams and hacks on the internet should a very big concern not only gamblers and casinos but everybody that clicks anything online. I know that casinos are not relenting to find ways to cover their tracks to avoid scams and hacks. But can there ever be a time when these criminals will be out out their jobs, I seriously doubt it, our securities including the casinos are in our hands, nobody can hold the internet responsible.

I have also never heard about the scam of double-spending. But it may happen and might not be disclosed as the gambling site never disclose like this issues. If they publish, then they might have the more trap about it and it is perfect as you can see no scam accusation by any gambling site.

There were reports in the past of some dice sites claiming they were victims of double spending. You can find news or even forum discussions about it from back then. Probably some sites kept it private so they wouldn’t get exploited further, but eventually they made adjustments and started requiring confirmations.

GHash.IO and double-spending against BetCoin Dice
Double spending
BitBet Falls Victim To Strange Bitcoin Double-Spend Behavior

I also linked two cases before that happened and was discussed on bitcointalk:

Hash.IO and double-spending against BetCoin Dice: https://bitcointalk.org/index.php?topic=321630.0
[SUCCESS] Double Spend against a satoshidice loss: https://bitcointalk.org/index.php?topic=130764.0

Now that's very hard to happen because there is no real gain in accepting 0 confirmation transactions and its very risky because scammers and hackers are everywhere trying to take money out of crypto users and websites.

[Findingnemo]

question...
(1) Were there any casinos that actually got hit badly because of this?

Yes it happened in the early days and even in 2016 a casino representative mentioned it on Cheaters (double spenders) and what the gambling sites are doing against them

Here is how it works:
- Cheater finds a gambling website that lets you deposit with 0 confirmations
- Cheater sends BTC with a low fee, which takes anywhere between a few minutes to over 1 hour for it to receive the first confirmation
- Cheater plays on the website:
   ~ IF he is winning before the first confirmation hits, he "allows" for the transaction to go through (by not double spending) and then withdraws the winnings once the transaction is confirmed.
   ~ IF he is losing before there is the first confirmation hits, he double spends the transaction with a higher fee to another wallet of his.

It was a loophole and then later it is rectified with a minimum 1 confirmation requirement before the funds reflected into their balance.

[Russlenat]

Now that's very hard to happen because there is no real gain in accepting 0 confirmation transactions and its very risky because scammers and hackers are everywhere trying to take money out of crypto users and websites.

Casinos have already learned from their mistakes. It would’ve been better if there were no confirmations needed since that means instant deposits, but because of past exploits they now require at least 2 confirmations before crediting the amount. That’s just how it developed.

But that was back when Bitcoin was the only coin for gambling. Now we’ve got different options with altcoins, so it’s not really a problem anymore.

I think you used the wrong words... not smart gamblers, we are talking about smart/clever scammers.

okay let's call it clever gambler, but regardless though, they are still smart, but unfortunately they use it on the wrong purpose.

[iv4n]

But that’s where some smart gamblers took advantage and pulled off double spends, sending the same transaction elsewhere before it confirmed, basically reversing the original deposit.

I think you used the wrong words... not smart gamblers, we are talking about smart/clever scammers. I remember some discussions about the double-spending exploit... faucet & bonuses abuse, different bugs & errors exploit, and many other scams.

The crypto gambling scene was a "wild west" back in the days... in many ways it still is.

[Outhue]

Stop confirming payment via the blockchain when it's not been confirmed yet, there was also a time where a 1 confirmation on Bitcoin blockchain can still be reversed, many people and business lost a lot of money because of this, people ended up learning the hard way, especially online casinos, they are one of the most  affected.

Gone are those days now, people and businesses now have better understanding of how the blockchain transaction works, more than one confirmation is required before your payment can be accepted as paid, even online crypto exchanges will tell you to wait for 30 confirmations on the blockchain before they can make your asset available for you to use, it is one of those lessons.