Topic: Cheaters (double spenders) and what the gambling sites are doing against them (Read 3059 times)

So someone can use 1ntc and play till they win big ? Has this happened ? How much habe people gotten away with ? Its very interesting but it sounds like people would clean you out so how did you stop that from happening ? Surely the cheater can't use this over and over untill he is happy with his profits ? Or can he ?

Nowadays, bitcoins confirmations takes a lot of time to confirm not only 2-3 minutes (most of time) ,but 1 confirmation policy is a must for every casino.

In your case they will need to do a lot of home work so is not it better to just keep 1 confirmation for the deposit to the site and nowadays it do not take much time for the first confirmation to happen. It only take a few seconds and sometimes a minute or two.

Seems like the current state of bitcoin has made most sites abandon their 0 confirmation policy. LuckyBit was the site I thought would keep this for the longest but a while ago they had to move into 1 confirmation policy too atleast temporarily until some kind of a solution was found. I think Satoshibones still accepts these so maybe reaching out to them would be an option.

In that situation 0 confirmation is just a window for the cheaters to play for free. before reading your this post I was wonder that why the gambling sites are against the 0 confirmation and do not pay the winning of transacted bitcoins with 0 confirmation. For the security of everyone it is beneficial that everyone adopt 1 confirmation policy.

Would love to hear from other gaming websites regarding this issue!
Happy Holidays everyone

I think the only way to make sure people can't cheat is to require 1 confirmation on deposits.  It sucks as a player, but if the site has an account for the players it isn't so bad.  You can deposit a larger amount, and you will only have to wait for that first confirmation, but you can play many rolls/hands off of that one deposit.

I used to play a fun Pachinko style game that was obviously took 0 confirmation bets because the ball would drop as soon as you sent the transaction.  The site was really fun, but it hasn't been up in a long time.  I'm sure that cheaters were taking advantage of 0 confirmation bets and just double spending their losing bets.

That solution doesnt work because they arnt double spending if they win. If they win they just let it go through. They only double spend
when they lost it all so basically they dont lose the btc they sent.  I would just make people wait and get the 1 conformation to be safe

Nothing ias wrong with 0 deposit. It helps speed it up to get players playing soon as they can. You can't double spend anymore.
If it is a problem the solution will be easy. Just make no withdraw until deposit is going through. Also if so many transactions fail then flag the account.

I thought they fixed the double spending problem. You speak about not like its as easy as turning a light switch on when its not. Its very difficult if not impossible to do these days. They increased sexurity on the blockchain because people were having double spend problems as well.

OMG now day how all hacker and user try to find way to trick the website to get bitcoin ..in anyway they can ..so this i quite good finding ..hope like this new trick will be found and taken action to stop it

they just ask people for confirmations when they make a deposit because i doubt it is possible to cheat with the deposits though that is just my thoughts

It was happening for us nearly every day. These cheaters are professionals that do this for a living.

Hi, new member here, but not new to btc casinos.

I remember one time playing at mbitcasino 1 of my deposits for .5 btc got double spent and I have no idea how. I had no clue it got double spent as I lost the entire deposit. Months later, after many more deposits I finally won but they would not let me cashout.  When I contacted support they said a deposit from months ago was "double spent" and never went through.

They wanted the .5 btc taken out of my current winnings because some deposit from over a month ago supposedly got double spent and never went through. I was pissed to say the least, especially since I've deposited 20+ BTC over the past year or so, without incident.

It literally took 1 month to straighten out and in the end they did not make me repay the .5 btc. To be fair, they even credited my account .5 btc without playthrough for the hassle.

I did not do the double spend and they a knowledge that. Has anyone ever heard of anything like this before? I mean, the supposed double spend deposit they never received was played and lost.  They continued to allow me to deposit and lose and the 1 supposed double spend only came to attention when I tried cashing out.

This might be a little confusing. If so I can provide corresponding emails I had with mbit at the time...

As a player, I understand the need for at least one confirmation.
As a Mod on a dice site, I often see people wonder why their deposit takes so long. Especially when it takes a long time to find the next block.
Unfortunately, there is nothing to do about this, other than using a faster altcoin or changing the fundamentals of Bitcoin. Both aren't really an option.

Don't forget that Sathoshi's original recommendation is to wait for 6 confirmations before you can fully trust the transaction. One confirmation is already moving far towards a better user experience instead of full security. I know at least one exchange that requires 6 confirmations before you can trade.

It seems you don't really understand what people are actually discussing about. The problem isn't withdrawing a double spent deposit, but rather people depositing money that can be easily double spent, gambling with it a risky way (like going 2x with his entire balance). If the bet wins, then he will let the deposit confirm and not double spend it. If he loses, he double spends the transaction and even though he lost money, he didn't actually lose it because he changed the transaction, and the gambling site owner gains nothing, but has a chance to lose money.

I didn't look for it yet, since I was on my phone and it's hard to look for stuff on the mobile version. It is a serious thing for gambling site owners. Sure, it might not be done everyday, but one person could do a deposit with 1 bitcoin, double spend if he loses, but he could try bets like 10x, which would allow the casino owner a chance to lose 9 bitcoin with a very low chance for reward (the double spend fails). Even if it's done once every week, it still hurts.

Well i think better way to deal out is to stop the withdrawal or payout(onchain) until the deposit by a user/player gets 1 confirmation or further more confirmations that a site owner is suitable with.Also same should be with account balance transfer.Most of the sites uses that to prevent loss of double -spending

there is nothing to find it is literary on the first page of blockchain.info
https://blockchain.info/double-spends

and i gotta say this is not a serious thing, nor a common thing that happens. look at this page and look at the dates and times the newest one is from yesterday. so it is not like people are double spending thousands of tx!!

also i should add that from all that list not all are fraud. there are times where you double spend to include more fees for your tx to get confirmed.

p.s. this is avoidable easily with 1 confirmation requirement.

Umm, pretty recently? Double spending happens every day, and most people don't really look into it. Why bother anyway? Blockchain.info has a list of all double or triple spent transactions, I will see if I can find it. Double spending is definitely possible and even if it happens infrequently, it must suck for the gambling site owner to have to pay out a win that could have easily been double spent if he lost.

Double spending is so very difficult to do, if at all. I wouldn't even be worried about it. I mean when's the last time this has even happened ? I haven't heard of double spending forma very long time.

It seems pretty safe and if something is not looking good they will delay bet until it is confirmed

As far as I am aware LuckyB.it system is pretty flawless as it is.


Currently the precautions they take (that I am aware of) are:

-0.0002 fee per KB with always a minimum fee of 0.0002 for instant bets
-Unconfirmed inputs must have 0.0002 fee per KB also
-The transaction must not have a malformed signature or a RBF-enabled one
-Transaction must not have output of less than 5460 satoshi

(credits to stingleword for the more detailed information)

Besides that they will not go into detail regarding the algorithm they have

Very good comparison! Thanks for the feedback

Well, I might add that the same type of scenario played out in the credit card taking online casinos.  I've witnessed it many times.  A person would credit his account with his credit card, make very risky wagers hoping for a large return, and if they'd lose, they'd just refute the charges on their card.  Of course, if they won, they'd just allow the charge to go through and then withdraw their winnings.

Mandating a one confirmation standard for bitcoin before wagering is allowed is quite generous....allowing a zero confirmations standard is the same as allowing credit so that's a risk....gambling with credit is very risky for several reasons.  And, it's not a good practice to permit.

It was fixed 0.0002 btc per 1 BTC.

Not many people have the intelligence or know how to be able to double spend. It is a pretty disgusting thing to do though. People shouldn't try & pull those kind of dishonest tricks

What was transaction size? 0.0002 per kb?

Yep, we switched to 1 confirmation deposit also. We had one double spent deposit with 20k satoshi fee.It's not really safe to allow instant deposits with higher fees.

It seems like we got the answers we were looking for. For now the 1 confirmation deposit policy will remain!
If any other website owners are having similar issues with 0 confirmations, I encourage you to do the same and protect yourselves from the cheaters.

Yes it is true that safety must come first but if people wait too long just to deposit, how secure your site is they wont come to play because need need fast deposit. I think safety and confirmation of deposit need to be balance so this will attract more people

Which is exactly why we would rather do a 0 confirmation deposit policy. However safety must always come first I guess!

If there are no new blocks you can wait 1 hour even if you put 1 bitcoin fee

That's correct, we've seen confirmations take up to an hour with the recommended fees!

When the network is under heavy stress or under stress tests even the 0.0002 BTC fee may take some time to be included in a block.


It is an improvement, but of course not the solution for everything

Will try to get in contact with them and see how they do it

That's exactly why I wanted to have this discussion and see where the other gaming sites stand!

Yes you are 100% correct!

Thank you for that link will take a look in a minute to see how this is done. The shady scammers seem to be able to sit around all day dreaming up ways to take advantage of bitcoin aspects and I hope one day they get a dose of their own medicine.

1 confirmation is the standard (afaik). Allowing 0 confirmation deposits would certainly be a vulnerability if there are no checks on the tx fee amount etc. like luckyb.it does.

I could see this happening whem I first read about a particular casino accepting 0 confirmation deposits but thought they would overcome this problem before implement if possible.

I guess the guy who is trying this would sort of be in a race withhimself and the miners.
He needs the first low fee transaction to take say 5min minimum to be accepted into a block (probably longer in most cases of small fees)  and also try win or loose quick so he knows which transaction to push or double spend.

I would think that most bets these guys are making a high limit on games like roulette so they can bet the lot in one go on something like red/black win bets.

I wonder how there are still some casino's that are able to offer instant play with 0 confirmations? This seems to be something that's fairly easy to exploit and make a huge profit with in a short time.
This combined with instant payouts would be quite detrimental for the site.

Check this : https://bitcointalksearch.org/topic/ghashio-and-double-spending-against-betcoin-dice-327767 (Betcoin Dice)
https://bitcointalksearch.org/topic/double-spend-on-pocket-dice-1128950 (Pocket Dice)

well double spend is a serious problem and as i said earlier gambling sites should accept deposits or show balance only after 3-4 confirmations.

so how many cheats has happened so far, can you give some statistic on it with how much BTC did they cheat?

you can always do it like others with at least 1 confirmation, and also you can add other altcoins which will be confirmed super fast like Dogecoin.

I don't think this double spending exploit is really that common, and I have no idea how much gambling sites are losing because something like this exist.
If that is really that bad and big money are being lost because of that then I think we are unfortunately doomed to eventually switch from 0 confirmation deposits to 1 confirmation.

that won't do. every time you make a transaction you'll always spend all of the coins in the input. that $2 will be sent back to your address or your change address, creating a new output for the next transaction to refer to (as input).

Hello does this means that lets say i have $5 btc in wallet, for the first transaction i sent a $3, which will left me with $2, but then before the transaction got sent i send another $5 btc at the same time? Is it something like that? Thanks for the explanation

this kind of double spending is called race attack. it is done by creating another transaction that spends at least one input that was used on the first transaction. once one of them got confirmed the other will cease to be a valid transaction and never confirm.

IMO the only sure way to stop gambling sites from getting cheated is to stop accepting 0-confirmation deposits.

is this method really working with current RBF?

seems thats another vote that RBF sucks ;x

Totally agree with bitbaby that even 1 confirmation is not sufficient , a double spending may even occur even after 1 conf. if miner also participates.Well now most of bitcoin wallets have disallowed it but gambling sites should take up some preventive measures and IMO at-least 3 confirmations is the best as of now.

I am not exactly sure how double spending works, but I can assure you that these cheaters have it down to an exact science!

Also I believe it's called a "Race Attack" which you can read about here:
https://en.bitcoin.it/wiki/Double-spending

No one wants to help me understand how this works? Always hear about waiting for confirmations but never read how people are able to cancel a transaction?
Was thinking this should not be a issue but forgot about people being able to create infinite accounts.

Yours is not the first site it has happened too, the biggest sites have faced this problem and the solution you implemented is the best solution there is, one confirmation on a normal day should take on average 10 minutes and its same for everyone so gamblers have to wait that much to play at any casino.

Up to 1 BTC, 1 confirmation should suffice, over that you should wait for at-least 3 confirmations.

The cheaters act like this:
Create account #1 -> deposit BTC -> they lose -> they double spend
Create account #2 -> deposit BTC -> they lose -> they double spend
Create account #3 -> deposit BTC -> they WIN -> they allow the transaction to go through -> transaction confirms -> they request a withdrawal

So in this case, we wouldn't allow accounts #1 and #2 to withdraw, but we WOULD allow account #3 to withdraw, since it has a confirmation. But it is still a cheater's account.
As you can see, it still does not help us because the cheaters are able to constantly create new accounts with different IPs and emails until they win.

I really do not understand how double spending works,always presumed you need the funds in the wallet to actually send something and I have never canceled a transaction. Actually had no idea that this could be done are there threads on how this is done,so I know what to look out for in the future if I ever do end up in a potential situation like that?

The solution is simple. Lets keep 0 confirmation deposit as it is a nice feature to have. But instead put a restriction on a withdrawal -
Unless your deposit wasn't  confirmed  you can't withdraw it. It is as simple as that.

I'll send them a message and see what they do to protect themselves

They could, but if the fee is high enough, it should be confirmed very quickly. I'm not sure how luckyb.it does it, maybe send one of the owners a PM. I was just stating what I knew. It also is a lot more risky if you put a high fee, which might repel some people that want to double spend. Maybe if a tx has a combination of decent fee/small tx size and small sized deposit, then you will accept it without a confirmation. From my playing at luckyb.it, when ever I use a fee of 0.0002, even before it's confirmed they send my payout to my address. Seems like it would be easily exploitable.

I never thought that a deposit confirmation 0, has a pretty adverse impact on the owners of the site and I also do not think that there are people who can take advantage of this. I feel your actions to address this issue have been very correct, considering if it is not soon resolved so many gambling sites that will have the impact of this.

NitrogenSports has a 0 confirmation policy I think but they do manual auditing of any outgoing transactions so I don't think this kind of shit will fly under their radar probably you will be banned and your funds will be seized if you try this scheme. I think DirectBet allows 0 confirmations on their bet deposits as well but I haven't heard of anyone trying to exploit their system. These scams are probably best performed on casino sites as sportsbetting requires a lot of time for the events to finish.

There are many places that accept 0 confirmation deposit. (NitrogenSports,Bitsler)

this is strange i have not seen any place that accepts bitcoin with 0 confirmation and even if they do it is so rare and they only accept it with 0 confirmation if the transaction size is really small.

Wow. Seems like cheaters are getting really smart these days with these scams. I guess the website needs to wait for at least 1 confirmation then.

I don't think 1 confirmations will be a big problem... After all, i think most bitcoin users are used to wait for one confirmation when they use their coins in other places.

interesting, but so far all the sites that i have played at are accepting 1 confirmation minimum, never seen 0 confirmation yet.

you can do a couple of things:
- accept 0 confirmation for small investments to lower the risk and lower the loss in case of fraud. and ask for 1 and more for bigger investments.
- also you can also check the fees that are included in the transaction or in other words check the transaction's priority to make sure it is high and going to be confirmed soon.

Never heard of anyone getting away doing this before as I am sure the casino sites have anti-fraud contingency plans in place so this doesn't happen when you put in a deposit on their site. If not, then their security department needs to be replaced with capable staff to code the proper script for the confirmations when they are coming in.

Correct me if I'm wrong, but aren't they able to double spend regardless of the fee amount simply by putting a higher fee for the same transaction before the confirmation hits?

You could do what luckyb.it does and wait for it to confirm with a low fee, or have instant play with a fee of at least 0.0002BTC. Should stop most double spenders, as it needs to be a large tx size for it to not confirm for a while with that kind of fee. Most players won't really notice a difference with paying 4 cents extra for the fee if they can play instantly, but it protects you a lot more. It also shouldn't affect the people that like small fees, since they can choose to wait for it to confirm.

I see that this is the best option other than that , because like what you told this scammer will find lot more options for this cheating.

Have you tried to male only deposits with sufficient fee available for playing instantly?(check Bitsler)
I play BJ at Coin Royale and they allow 0 conf. deposits for my account.

It recently came to our attention that many people (including people on this forum) are attempting to cheat on gambling websites (especially those that have a 0 confirmation deposit policy)

Here is how it works:
- Cheater finds a gambling website that lets you deposit with 0 confirmations
- Cheater sends BTC with a low fee, which takes anywhere between a few minutes to over 1 hour for it to receive the first confirmation
- Cheater plays on the website:
   ~ IF he is winning before the first confirmation hits, he "allows" for the transaction to go through (by not double spending) and then withdraws the winnings once the transaction is confirmed.
   ~ IF he is losing before there is the first confirmation hits, he double spends the transaction with a higher fee to another wallet of his.

This effectively gives the cheater a window of a few minutes to play and decide if he wishes to allow the transaction to go through or not.

When we had our 0 confirmation policy, this happened to us (www.BitcoinBlackjack.com) many times.
And now that we implemented a 1 confirmation policy it seems that the cheaters have taken their scam elsewhere.

We have personally spoken to many other gambling site owners on this forum, and many of them have also switched from a 0 confirmation to a 1 confirmation deposit policy in order to protect themselves.

Unfortunately, this does not benefit the experience for the players (since they have to wait for their deposits to confirm each time before playing). But it seems to be the only way to combat double spenders.

What do you guys think? Players? Website owners? We would love to hear from your experiences and see if there is a better solution.