I'll post an update tomorrow. Just to clear things up quickly: The hacker stole Bitcoin from the Hotwallet by depositing non-existing BTC. I analysed all the player deposits and no player had any such fake deposits. This only happend on the BTC site, so NXT site is completely unaffected anyway.
How were they able to deposit fake BTC? Is this something that would be easily fixable?Yeah, I'm not following this either. TTM waits for confirmations, so if the network has confirmed them, they should be good (aka not fake). Plus if no accounts had the deposits, how were they able to withdraw?
.Short version: we used block.io as a callback provider. Someone bruteforced the deposit password and our system trusted this source (should have double checked)
Really interesting stuff! I wouldn't even know where to start when exploiting things like that. As irritated as I get when people do hacks like this, there's also a certain level of respect I have for their ability to find loopholes and such.
That said, I wish they'd leave TTM (and my investments!) alone, :p.
