Hi respected forum members, please consider this as a dispute at the moment. Negative feedbacks could damage their reputation. Right now I don't see the need for it. I strongly believe their decision to void wins and losses over many days is ridiculous. Please share your opinions on who is right here.
tl;dr - Bitsrace want to remove $579.65 of my balance won by risking my capital. They don't have a good argument or evidence to justify this. I don't even know if their story is true, but they do sound genuine. They are saying they suspect their races were compromised, so they by themselves decided to void all my games across the day across all games across all rounds, even though they themselves acknowledge I am very likely innocent. I have bolded circumstantial evidence that supports my case. There should be hard evidence that I am innocent but that should be with bitsrace, because they have all the data.
What happened:: On January 19, while browsing bitcointalk I came across bitsrace. The game looked different from the usual, so I signed up, and deposited about $200. They were offering deposit bonus, and I enabled that, and my balance came to about $400 with wagering requirements.
I tried their card game first, and almost lost the entire balance in a losing streak. Then I tried their horse race game, and I went from $400 to about $800 while completing the wagering requirements. This made my day.
I request a part withdraw and it said I will receive the money in 30 minutes. Next day I checked the wallet and I hadn't received anything. I logged in and found that my withdrawal was in failed status, but my balance was reduced. I contacted support, and they corrected it. On January 20, I requested a full withdrawal again of $814.02 after playing a bit. This was rejected. And the first withdrawal which was in failed status, now showed rejected.
My thoughts were did I perhaps break any bonus T&C? I am sure I didn't abuse anything, and I couldn't understand why my withdrawal was rejected. I had checked the forum and found that players had received their withdrawal, so I couldn't understand what the problem was.
I contacted them by email. They are taking away about $600 of my money, and I am supposed to suck up to it. I am an innocent player, between the hacker who committed the crime and the casino that don't keep logs, don't have evidence, and didn't have proper security, why am I losing $600 for their crimes and mistakes?
This is like somebody broke into their house and took some of their money and they think it is completely alright to break into my house and take my money. This is the strangest decision I came across in my 10+ years of crypto gambling.
I don't understand how they think somebody attacked their API if their claim of not having logs is true? Shouldn't they have something?
Scammers Profile Link: https://bitcointalk.org/index.php?action=profile;u=3739604Reference Link: Amount Scammed: $827.45 - $247.80 = $579.65
Payment Method: Bitcoin
Proof of Payment: Deposit transaction:
https://mempool.space/tx/fd31dbfd856a14a050b34a2a891e112bc4237535680cbca708f38ff812ebd754 Proof of balance:
https://ibb.co/1YqpNzPYPM/Chat Logs: ... (skipping first few messages about contacting owner by telegram to discuss which I refused thanks to getting scammed by Telegram last year. I have developed Telgramophobia.)
Me:
What is your deal? My withdrawal is rejected. There is no explanation. Explain why my money is stuck these many days or I am opening a scam accusation.
I didn't break any of your terms. If betting on more than one horse isn't allowed, or some rule I didn't know of, tell me what it is, and address it either by removing the bonus part or asking me to wager certain amount. If you suspect anything, tell me exactly what it is so that I can address it. This is getting very frustrating. Delayed withdrawals are a deal breaker. If anybody is misusing bonus or something, just remove the bonus. Don't ruin the experience of everybody.
Bitsrace owner:
Hi there, this is the owner. I've rejected your withdrawal multiple times and in your transactions history, you should see a message attached to the rejected withdrawal. Each time you requested a wd, I put a message asking you to contact me on telegram to process the withdrawal.
The reason your withdrawal was rejected is because this:
At the time of your wagering, there were undiscovered exploits and errors related to the live racing game. These exploits allowed bettors to have +EV strategies by betting on a certain combination of horses AND allowed them to brute force our API to access the results during the betting phase. You saw the banner when you requested your first withdrawal, I was working to fix the issue as fast as possible.
You were not the only user affected by this. I understand that it's not your fault and there is a possibility that you weren't using these exploits while wagering on the site. Nonetheless, if I make a decision, then I have to do the same thing with every other user, otherwise it would be unfair and biased.
Thus, for every user (those who lost their deposits and those who increased their balance), I can't honor the losses or winnings incurred during the last few days.
As for you specifically, based on an analysis of your betting history and account, I don't believe you were exploiting the website. However, I can not know for sure so I can't honor your full balance. So you may request a withdrawal for your original deposit + $50.
Sorry for the delay, if you messaged me on telegram this would have been sorted 2 days ago when you first requested a withdrawal.
Let me know if you have any questions, or you can message me on telegram to get faster responses.
Me:
Hi, I have no idea about any exploits. There is one thing I noticed - I was getting rackback for plinko. But the default high risk line is the same one Luckyb.it used when it was running and their house edge was 1%. I haven't done the calculations, but it is possible that plinko game is 1% positive EV. Or may be I am wrong and the house edge is 3%. If I was really the kind to exploit the game, I would make an Excel, do the calculations, create multiple accounts, deposit and play plinko for hours in auto mode.
My play is fair and square. If you don't have time you can specifically check the wins that increased the balance. Those bets were high risk. If I was employing a +EV strategy, I would drag it out through hours.
Why is it not possible to check for sure? I think the significant wins were around 10 bets or so? Even if you don't have the time, you could still check those few bets and see if there was anything suspicious about it? Since you have all the data, you can simply check the specific rounds? I am positive you have the data to check my bets.
In my honest opinion, a decision to void both wins and losses is unfair and biased. You should honor the players who played fairly, and forfeit the deposit and balances of those hackers or whatever exploiting it. Please go through my bets history as much as you like, and check.
Isn't it possible to check if I was accessing any API or provably fair from my account? Isn't all that logged? I think you should have enough evidence to figure out that I didn't do any shady stuff. You can take $100 off my balance to cover your time, I am fine with that since the bonus you gave was $200, I won't consider it a loss. But my wins are 100% mine.
Bitsrace:
No, I can't specifically check, because you can mask your wagering. Bet on losers and bet bigger on winners. I have to take the same measures with every user. Even if you had lost money, like some users did, I would be refunding you.
Me:
This is very unfair. I think you are not even trying, you just found a lazy solution to it. I played fair, if I lost money, I won't be asking about a refund. Email is not provided, and you won't contact me either.
I don't really get why I should take a loss of $600 and why you are giving any money back to those hackers? Even if you can't be sure, you can check the bets and see if someone is very likely abusing your game or not.
Can't you at least check logs of your API and see if anybody accessed the results of the rounds I won? Have you checked the times of this attack vs my bets?
If you provide me the timings of this attack in UTC time, I can compare with my bets and prove it.
I also remember when I was betting the house edge was around 3%. Was there really a positive EV bet possible? How much positive EV are we talking? 1% or something?
Isn't this a far better solution, instead of treating players and hackers the same way?
This is what happened, right?
1. bitsrace generated round
2. hacker attacked and got results in advance for the round
3. hacker made bets and won
I think for each round of horse racing the hacker has to do this attack, right?
You should definitely have logs of which IP, which time, which round the betting integrity was compromised.
If you find hackers IP you can just seize the balance in it and any future deposits from that IP. That's only fair.
Instead of voiding everything in a very large timeframe, it is far more responsible to void only the bets in the affected rounds.
If you are going to claim you maintain no logs at all or some bullshit like that, I will only take that this is made up excuse.
I would like to add that, there is obvious circumstantial evidence that I am not hacker because:
1. I deposited about $200. The hacker has no reason to risk that much. I think he would be depositing $20 - $50 and withdrawing a large amount.
2. I took the deposit bonus. The hacker would prefer to go for few lucky wins rather than wager over $3,200. Bonuses, and longer time it takes to complete wager, and number of bets (considering statistical analysis) will increase scrutiny of the withdrawal. The hacker should deposit $20 to $50, not take deposit bonus, make a few winning bets mixed with a few losses, and make a large withdrawal like $200 to $2000.
3. My withdraw request is just 4x of deposit or 2x of deposit and bonus. The hacker should use little of his own capital and withdraw at least 8x to 20x or even more.
4. If you look at my bets, I lost close to half of my total balance and almost lost the entire balance in the card game. If I was a hacker I don't need to lose this much and risk losing the entire balance on another game. The losses mixed in by the hacker won't be as deadly as that.
If a criminal is hiding in a village, you don't bomb the entire village and call that "fair" and "unbiased" decision. You do have more responsibility over this than I do, given that you could have done something better like avoided any security incidents by being more careful, and there is nothing I could have done better or in a more responsible way.
Bitsrace:
Yes, +EV bets were possible. 1-2%. I don't know which rounds were compromised, because I don't have the ability to see who accessed my API when. I have logging for when bets are placed and by who, obviously.
This is what happened:
Every round, I generate the results for each race. These pending results are displayed in my DB. Hackers used my DB API to access the pending results during the betting phase and masked their betting while making sure they came out on top.
I'm not giving money back to hackers. I'm resetting the transactions for every user BESIDES the exploiters. Otherwise, it's not fair to the people who lost money during the exploit. I can't pay out the winners and keep the money from the losers. The most fair way is to reverse everything from that timeframe.
Moreover, I can't discriminate it on a race-by-race basis, because I don't know which rounds had legitimate activity and which ones were exploited.
After talking with my partner, this is the best I could think of.
Me:
I don't really get how you think it is fine for me to pay up $600 and a few hours of a time for your mistake. I am not going to yield and pay up for your negligence in securing your API and also not maintaining logs. Are you sure you don't have any logs? I thought all websites have all kinds of tracking like cookies, analytics, logs? If the hacker received the results of the race, that was served up by your server, there should be something for that.
If you don't have logs, how did you conclude your API was attacked? So you should have logs. Check with your developer.
Every bet I make with my money is under a basic contract between me and your website that I am either winning or losing it. Voiding is fine if there is malfunction in one round or I exploited the game, or something like that. You are casually voiding hundreds of bets over a span of hours just because you can. This is just blatant misuse of the authority you have.
Look, if anybody accepted this kind of deal, they are probably guilty. The hacking and the negligence is between you and the hacker, don't drag me into it.
I played by the rules and my entire balance is mine. If you want to take my money, bring evidence. Tomorrow I am opening a scam accusation since clearly this is going nowhere. $800 is like 25% of my gambling bankroll. I lose sometimes and win sometimes, last week I lost about $400 in other places and won $600 in yours. Just because you have access to my balance deposited in your website does not mean it is all yours to do whatever you want.
Your best decision is absolutely ridiculous. You lose trust. Instead of giving bonuses, start by being reliable.
Bitsrace:
You're not paying anything. You deposited $200, got $200 in bonus money, and ran it up to $800. I said I would return your original deposit, and $50 as a condolences for my oversight with the odds generation for the live racing game. If I was scamming you, I would keep your original deposit. It's that simple.
A more technical explanation of the issue:
[redacted to avoid revealing sensitive info]
Again, I'm sorry for the inconvenience and about the situation. If I had bad intentions I would either solely return your deposit, or just keep it. I'm not. I'm offering you a free 25% on your initial deposit as a 'sorry, we messed up' fee.
Me:
The $800 balance is my money I played by risking my capital. I can't give you $550.
In my 10 years of crypto gambling I have never heard such a ridiculous argument. It is only fair to you, not fair to me.
Additional notes: There are some parts here that is false. " you should see a message attached to the rejected withdrawal. Each time you requested a wd, I put a message asking you to contact me on telegram to process the withdrawal. " - there was no such message. I emailed support and they asked to contact via Telegram. The withdrawal page don't have this message. If it is important I can provide the screenshot.
" You saw the banner when you requested your first withdrawal, " - this is false, when I made first withdrawal there was no banner. I saw the banner the next day when I logged in after checking my wallet and finding no receipt. These are not important, but my view of bitsrace is now that of somebody careless.
If the suspected positive EV is 1%, even if I was abusing it (I wasn't, and I still have no idea how it is possible to do that when the house edge was 3%, effectively 1% house edge including rakeback), the net benefit is only $35 over $3,500 wager. The API hack can be more dangerous, but if I knew of it, I won't be risking my entire capital on another game (please read bolded text with 4 points) and also "As for you specifically, based on an analysis of your betting history and account, I don't believe you were exploiting the website."
I don't understand why I should be punished instead of first, the hacker who exploited the website or second, the casino owner who did not secure their casino or keep logs.
