Topic: Vulnerabilities in gambling websites in past - page 31. (Read 6924 times)

I remember this. This was in 2015 or 2016 IIRC. The exploit only lasted for a couple of days before they patched it up. I didn't have the energy to create multiple accounts back then in order to take advantage of this bug in their system. Good thing they patched it quickly right before anyone else can abuse it hard.


This one I don't think any service or platform still implements nowadays. The minimum that gambling platforms require before the balance appears on the account is one confirmation, and is enough to protect them from double-spending accounts for the mean time.

There is also a certain casino (betcoin.tm, now down due to scams) wherein their slots have this predictable pattern that you can exploit and make lost of money with. It may not be a vulnerability but it's something people at the time can certainly exploit. Won around 1 btc because of that game with a starting capital of 0.01BTC

But in the case of the casino, once it's hacked that's the end of that casino, only big casinos offer refunds or protect their player's money compared to exchanges where they can do a refund and insured their trader's money, I don't think there's the same guarantee that they can offer that they will do a refund.

Here's some similar scenario but this one only talks about 35 BTC.
https://bitcointalksearch.org/topic/rollinio-hacked-1340581

It was on Rollin.io which is already dead or down as of this moment.Nothing on this world is unhackable no matter how tough the security would be.

As you mention, there have been a lot of Vulnerabilities in the past. I have personally reported vulns is some gambling sites, the ones I remember was:

1.- 999dice (The site is already down)
The faucet used to pay huge amounts, something like 1000 satoshis each 10 minutes. And there was a tip engine with a limit of 0.001 as the min amount. The exploit was about claiming the faucet with multiple accounts and collecting it with tips, I call the bug the Snowball because each tip you collect it grow 1k sat. So, let's say you claim the faucet with 100 accounts, and send a 0.001 tip to the first one, then send 0.00101000 to the second one and keep collecting all the other ones.

For reporting this I get a bounty of 0.025 in 2015.

2.- Prime dice
Some years ago this casino gets an update where each time you make a withdrawal you get back 0.0001... so if the min withdraw was 0.001 then you could earn easy money with this. I depo 0.1btc to my account, then send a tip of 0.001 to a second account and withdraw it. i get 0.0001 back, then I send another 0.001 tip and now withdraw 0.0011, I get back 0.0001, and I repeat the process a lot of times. Before I finish with the starting 0.1 the site blocks my account with close to 0.03 on it. and I never recover that money. I was just getting information to report the bug, ut for them I abuse the system and they never give me my money back.

It was a long time ago, and they do the right thing, even If i was about to report the bug i should do it from the start when i detect the bug and not after exploiting it, so, it was my fault.

3.- No confirmation sites.
Any site to allows you to gamble with nonconfirmed coins is vulnerable to a double-spend attack. People could wager their balance and if they win then waits for the transaction to confirm, and if they lose they could make a double spend, that's a known vulnerability.

I hope this information helps you in your development.

There had been quite a number of Vulnerabilities in gambling websites since 2011 from satoshi dice to primedice and a lot more.

What was the total number of exploits and which ones were the lethal ones, I think that hufflepuff guy on primedice did the most damage.
The exploit was called something like "Race time condition" and I read something similar in my CS class but it was related to a banking system so it could be different.

Basically, it was giving multiple inputs to the system trying to get some response from the system in 2 places, and then exploiting the system.

Also, Is there any list for me to check regarding exploits? I'm thinking about developing something so it may come handy.