2UP.io | No-KYC Crypto Casino & BTC Sportsbook | Fast Withdrawals + 200% Bonus

[khaled0111]

Glad to hear that this problem has been solved and that the affected users got their money back.
This incident may serve as a reminder not to take account security lightly especially if money is involved. The first thing anyone should do after creating an account is to activate all security features and especially 2FA.
Maybe, after this incident, the 2UP team will consider making 2FA mandatory and not optional.

[noorman0]

I'm curious about the hacker's intentions if he wasn't draining users' balances and was only interested in general casino games. I can't imagine how he could have placed bets with different accounts in such a short period of time.

I'm glad to hear that no significant losses resulted from this incident.

[BitcoinHunt3r]

I'm curious about the hacker's intentions if he wasn't draining users' balances and was only interested in general casino games. I can't imagine how he could have placed bets with different accounts in such a short period of time.

Their main target is obviously to take the money but they can't do it because security code works for withdrawal so maybe because they were a bit angry they used that balance
For things that make you wonder they must be using something for example using a Bots or something like that yeah this is not a new method I have seen it since 2015 on other sites
Another reason yeah sometimes this is just for testing by hackers on new sites therefore generally new sites will provide a Bug Bounty program.

[Eladzis]

Balance no longer showing, getting "network is unstable please refresh the page" error message?

Edit: my bet history is all gone or inaccessible as well as my player stats/withdrawals or history,.


I don't use 2fa only email so given what's been happening I think anyone should use the site with caution atm. I have no idea if I was hacked or this is some kind of precaution.

Also this is not getting into the account through the user but the website itself which is extremely concerning,

[Eladzis]

Im just going to double post instead of editing again but false alarm I just had to clear my cache. Just unfortunate timing lol

[Don Pedro Dinero]

I can’t recall a case like this involving an attempted mass hack on casino accounts in all the time I’ve been on the forum.

This feature automatically enabled when creating an account while if they want extra security they have to activate 2FA
I remember interesting feature in another casino, so when we have a balance, a warning popup will appear to activate 2FA well, maybe this is a good idea to implement here.

That’s right, that’s the lesson I’ve learnt from the whole affair.

The 2up.io team was outstanding, quickly addressing the issue and resolving it. I believe the casino genuinely wanted to protect its users, but due to the hackers actions, Some users were affected. However, team quickly worked hard and everything returned to normal.

I’m glad the story had a happy ending, with people reporting that they can now access their account balances, and some have even received a bonus for the inconvenience.

[Russlenat]

This is the kind of casino that should be patronized, since they are doing their job to make sure players are protected.

Unexpected things can happen, that is normal. But what matters is how the casino responds. If they are able to make the right move, correct the errors, and satisfy the affected users, then that says a lot about how they handle problems.

This kind of challenge is where trust is tested, and they passed it with flying colors. Those who were affected and had their issues resolved will most likely recommend 2UP to their fellow players.

[suzanne5223]

I can understand you're going through, but i would like to know if you have done some research about how session hijacking/cookie theft operates?
Although we haven't heard back from the 2UP.io representative, I am just telling you the chance of what may have happened to your account and other users who didn't use the 2FA, so you won't keep your hope up.

TOTP 2FA doesn't make you immune to session hijacking though, and it can still be bypassed. This is because when bad actors steal your session cookie, it is when it's already in a logged-in state. In other words, there is no need to enter the code because you are already logged-in.

However, for withdrawals, it won't work anymore as another code will be asked unless there is another attack vector.

Yes, 2FA does not make anyone immune to session hijacking/cookie theft, and to be honest, 2FA alone won't do the job because the user also has a role to play. Despite 2FA and all the roles the user has to play, no one is 100% immune to session hijacking/cookie theft, but the chance of being a victim is low, and it is better to be secure conscious than being sorry.

[mirakal]

So all the problems have already been resolved, right?

I hope we can see an announcement here about the result of the investigation. So far, based on my observation, no more complaints have appeared already, so maybe we can assume they were already compensated for their losses due to the hack.

All those recommendations, especially enabling 2FA, are very important to minimize the risk. Maybe it is time for us to really take our accounts seriously, because we never know when we might hit big. And if that happens, we would want our account to stay safe from this kind of hack.

[BitcoinHunt3r]

This is the kind of casino that should be patronized, since they are doing their job to make sure players are protected.

Unexpected things can happen, that is normal. But what matters is how the casino responds. If they are able to make the right move, correct the errors, and satisfy the affected users, then that says a lot about how they handle problems.

Yup, this incident has impacted their credibility and hopefully it can continue.
We know that recently several new casinos have left the forums with unresolved issues, well we are worried that other casinos will be affected especially newcomers.

So all the problems have already been resolved, right?

As far we know all those affected have been recovered, balance credited + bonus at least 4 users posted on this forum, but yeah the most important thing right now is that every user must activate extra security or even change the password to anticipate other things.

[Davidvictorson]

This is only a speculation at this point and we do not really know who/what was to blame for the whole thing.
Luckily, if I understand the situation correctly, whoever hacked/accessed those accounts was not able to withdraw the funds and was only able to gamble them, meaning funds only circulated within the system, so hopefully nobody was at a loss.

Thank you for providing further details into this. The hacker must be a rookie because how were they thinking we would be able to withdraw the funds without triggering the system?

I don't recall any specific case of a rogue employee in any casino site, but, back in the days, it was not uncommon for more traditional businesses to have problems with employees stealing customers' credit card details, especially for businesses that allowed bookings over the phone.

You are right. I think most of these rogue employees type cases happen more in physical casinos than in the online crypto casino.

[stompix]

I'm curious about the hacker's intentions if he wasn't draining users' balances and was only interested in general casino games. I can't imagine how he could have placed bets with different accounts in such a short period of time.

He tried to but never succeeded or at least there is no confirmation on that happening.
Then he probably just wanted to do as much damage as possible by emptying the account, not familiar with Mahjong Ways, but judging from what others say it was a higher bet slot, the perfect way to drain an account as fast as possible.

Well, one of those rare moments when you're happy automated withdrawals are not a thing.

[lionheart78]

I'm curious about the hacker's intentions if he wasn't draining users' balances and was only interested in general casino games. I can't imagine how he could have placed bets with different accounts in such a short period of time.

I'm glad to hear that no significant losses resulted from this incident.

I believe the hacker finds out that he is unable to withdraw the balance, so even if he got a hold of an account, having no access to the email won't let him withdraw the balance due to the needed OTP to process the withdrawal.  So he just drained the balance.  If it were a hack to steal the funds and withdraw, it obviously failed.

Anyway, I read that funds have already been returned to the hacked accounts. It was a fast action from the casino, it is really good to see how the platform acts and solves the issue in a fast and organized manner.

[knuckey]

I'm curious about the hacker's intentions if he wasn't draining users' balances and was only interested in general casino games. I can't imagine how he could have placed bets with different accounts in such a short period of time.

I'm glad to hear that no significant losses resulted from this incident.

I believe the hacker finds out that he is unable to withdraw the balance, so even if he got a hold of an account, having no access to the email won't let him withdraw the balance due to the needed OTP to process the withdrawal.  So he just drained the balance.  If it were a hack to steal the funds and withdraw, it obviously failed.

Anyway, I read that funds have already been returned to the hacked accounts. It was a fast action from the casino, it is really good to see how the platform acts and solves the issue in a fast and organized manner.

My account was also affected by several IP addresses accessing my account, but this is quite a strange incident, because logging in also requires an OTP from Gmail. I'm quite confused as to why they can log in without an OTP and they can't make a withdrawal because of the OTP.
This problem is a valuable lesson for 2UP to tighten user data security.

[lionheart78]

I believe the hacker finds out that he is unable to withdraw the balance, so even if he got a hold of an account, having no access to the email won't let him withdraw the balance due to the needed OTP to process the withdrawal.  So he just drained the balance.  If it were a hack to steal the funds and withdraw, it obviously failed.

Anyway, I read that funds have already been returned to the hacked accounts. It was a fast action from the casino, it is really good to see how the platform acts and solves the issue in a fast and organized manner.

My account was also affected by several IP addresses accessing my account, but this is quite a strange incident, because logging in also requires an OTP from Gmail. I'm quite confused as to why they can log in without an OTP and they can't make a withdrawal because of the OTP.

@suzanne had mentioned the possible reason why the account was accessed even without OTP,  and I also think that it is one of the possible cases.

I can understand you're going through, but i would like to know if you have done some research about how session hijacking/cookie theft operates?

This problem is a valuable lesson for 2UP to tighten user data security.

Not only for the platform but also for us, players and readers alike, that adding another layer of security is never a wasted effort.

[mirakal]

So all the problems have already been resolved, right?

As far we know all those affected have been recovered, balance credited + bonus at least 4 users posted on this forum, but yeah the most important thing right now is that every user must activate extra security or even change the password to anticipate other things.

Thanks for the confirmation.

Though this happened, it could be compared to a glitch within the system only, since no funds were taken out by the hacker. So in a way, it became like a stress test to see how the casino would handle this kind of issue.

Other casinos have even lost real money when they got hacked. I believe some famous casinos were hacked before too, but they were still able to survive and continue thriving after that. We don’t know if 2UP would be able to survive if the same kind of hack happened to them on a bigger scale, but hopefully it will not happen again. What matters now is that they improve their security and make sure users take account protection seriously too, especially with 2FA.

[Bitinity]

Surprised to get the Loyalty Reload for the first time because the amount is decent enough. It is a 5 days reload worth $21.5 per claim = $100+ total. After checking the information, loyalty reload is basically similar to other bonuses which is depending on wager, house edge and performance (I assume it is PnL) in the past 30days. I have wagered like $120k, average house edge should be 1% as I played mostly original games and PnL is positive.

[Mandoy]

I'm curious about the hacker's intentions if he wasn't draining users' balances and was only interested in general casino games. I can't imagine how he could have placed bets with different accounts in such a short period of time.

I'm glad to hear that no significant losses resulted from this incident.

I believe the hacker finds out that he is unable to withdraw the balance, so even if he got a hold of an account, having no access to the email won't let him withdraw the balance due to the needed OTP to process the withdrawal.  So he just drained the balance.  If it were a hack to steal the funds and withdraw, it obviously failed.

Anyway, I read that funds have already been returned to the hacked accounts. It was a fast action from the casino, it is really good to see how the platform acts and solves the issue in a fast and organized manner.

I believe that the hacker's initial goal was to acquire money. But the security system for money withdrawal was likely the cause for that not being accomplished. Withdrawals are made with the assistance of email and OTP, so the hacker might have realized that he will not be able to withdraw the balances straight away. That may be why some accounts were only utilized for betting activity, instead. The good thing is that the casino responded very quickly after the issue was discovered. The refund and the organized approach to the situation helped defuse. The situation and demonstrated a commitment to taking responsibility for the situation in the community.