[Abraham Lincoln]

EDIT: They still haven't fixed the issue. 3 months and the site is still vulnerable. I'd recommend you pull out all your coins from them.

So back in early December I was messing around on AllCrypt.com, working on some automation methods to save myself time, and I came across a huge vulnerability in their system. Essentially it would allow me to withdraw as much of any coin as I wanted from their hot wallet. I would estimate that to easily be in the 5+ digits USD wise.

I immediately contacted their support and reported the issue to them. They respond within a few hours and I communicated with them closely for the next day giving them information. In a few days they had it patched up. There was just one catch that surprised me, they locked my AllCrypt account, put my coin balances on hold, and stopped responding to my support inquiries. I messaged them asking for my BTC back.

39 days and 4 messages later, they finally responded with this: (I've edited it to remove any hints as to what the vulnerability was)

It took us forever to clean up the mess. Don't get snippy with "and I want [my BTC and OMC] back" - you were violating the terms and conditions of the site by [what you did]. By the terms you agreed to by your usage of the site, we have every right to leave it on lockdown. So you'll excuse us if we have other matters to attend to and repairing your account isn't top priority.

The balance has been restored. We added safeguards to protect against that sort of thing again. Don't go [doing what you did]. They will be flagged in the future and might result in an auto-IP ban from the intrusion detection system.

It seemed quite odd to me that they would treat someone who found, did not abuse, and reported such a major bug in this manner. To make it even more unusual a couple of months before I had been messing around and found a mysql bug in their system. Even though it was a tiny, completely safe bug, they gave me a decent bounty and thanked me for finding it. But now it seems everything has changed and suddenly I'm on the wrong moral ground. What is up with that?



Now, let me clarify some things:

I was in violation of their TOS. They had every right to do what they did. I do not deserve anything, no do I expect to be given a reward.

I am not complaining about the fact that I didn't receive a bounty.

I am simply posting this as I thought it would be fun to share.

No, I'm not going to give any details of this attack out. Don't bother asking.



tl;dr: I could have stolen a bunch of the money from AllCrypt.com, but reported the bug instead. They then blocked me from the system and ignored me, which seemed odd to me, considering my actions.

[Fʀᴀɴᴋɪᴇ]

They should be a bit more understanding and compassionate with you. You literally had access to their money and didn't take it.

They sound like (judging from the response) arrogant pricks.

Also: Congrats on finding the exploit.

[Illuminatiž]

That's what you get for helping someone nowadays.
You should have just withdrew a lot of money and bailed.

This is beyond fucked up.

[Abraham Lincoln]

Locking members' account who warn them is a bad practice. Who will help them next time?

Few months back there is a white hat hacker who exploit a vulnerable exchange but return back money later on. Maybe next time you can do the same way.

Since AllCrypt.com is not good, maybe we should find other exchange for OMC.

I would really like to get it on Cryptsy.com. From what I've heard it's a pretty good exchange for altcoins.

[adampelletgun]

That's a dick move by them.

Congrats on finding the vuln though.

[Abraham Lincoln]

Dude seriously? Fucking post it. Don't let people treat you like your their little bitch. Show them that YOU'RE THE ONE IN CONTROL.

It has already been patched. Posting it wouldn't necessarily cause any damage to them, which isn't really my goal anyways.

[Abraham Lincoln]

That fucking sucks man, Can't believe you lost your stuff.

I haven't lost anything. They eventually returned my BTC and OMC.

[Abraham Lincoln]

If it's been patched then post it still. What harm could it do?

It could result in other glitches being found and abused. And Tbh I don't know if they even fully patched it. From what they said it sounds like they just stuck a bandaid on it.

[Compl3xx]

You should of just fucked them over.

[Azraelstear]

OP: try to find new vuln and stole everything and let them eat their own shit if they are this much stupid.

[Gook]

next time report it to me, ill do the job 50/50 for you

[Moneybookers]

next time report it to me, ill do the job 50/50 for you

Indeed, you get threated like an idiot for helping them basicly.

Would have done it for less.

[Aceman]

I've had problem with AllCrypt's support in the past as well. The employees I had dealt with in support were quite rude and acted as if I was the problem when I was simply trying to solve an issue on their end. Guess that's what I get for asking them to update their wallet's nodes so that their wallets aren't offline for 5 hours. 🤫

[Abraham Lincoln]

Well, I just tested again today, and the site is still vulnerable to this exploit. I've also found multiple other exploits in their site that could easily result in the emptying of all their coin wallets.

I'd highly recommend that either not use AllCrypt at all, or if you do, only keep small amounts of money in your balance and withdraw them as soon as you've made your trade.

And no, I'm not selling any of these exploits.

[Aceman]

You should abuse it. Show that the money isn't safe and wait for them to sort it out if they want the BTC back. Or just keep it, their loss. You tried to help once and they didn't listen so instead of someone else finding it and taking it you should. 🤝 🤝 🤝

Would be kind of awkward if a member of the OMC team performed a 51%, wouldn't it?