[Gook]

next time report it to me, ill do the job 50/50 for you

[Doctor Blue]

That's why if I ever found a bug like that in some site, I wouldn't report it, I would get rich.
No companies ever seem to appreciate honest and decent people whom help them out.

I found one. Although it's very small and the exploit only allowed me to steal baby books.
Most others get cranky indeed. I don't disclose bugs like those anymore, the companies can get crazy mad. Furthermore it's not even legal to pentest a website without permission, not in Denmark anyway.

[Algo-rhythm]

Well mate, you proved that you are a genius.
And I think you really are one.
Glad that we have people like you on these forums. Take a bow man! 🤝

[Moneybookers]

next time report it to me, ill do the job 50/50 for you

Indeed, you get threated like an idiot for helping them basicly.

Would have done it for less.

[doodie]

I would report this to Bitcointalk and other BTC related forums, copy/pasting this will take you one minute and it'll cost them alot.
And they deserve to suffer as they are awful in both business and human approach

[Mons]

What terms did you violate this time that you didn't violate the previous time finding and reporting a vulnerability.

[Aceman]

I've had problem with AllCrypt's support in the past as well. The employees I had dealt with in support were quite rude and acted as if I was the problem when I was simply trying to solve an issue on their end. Guess that's what I get for asking them to update their wallet's nodes so that their wallets aren't offline for 5 hours. 🤫

[Yoshikage Kira]

That's quite rude of them, i'd report their behavior on bitcointalk.

[webdev77]

Seems odd they would do that, but something tells me someone took advantage of the exploit you found already.

---

I couldn't find any realiable alt-coins exchange except for btc-e

I use BTC-e and haven't had any trouble, so I will continue to use them for my small trades.

[Raoul Duke]

I've had problem with AllCrypt's support in the past as well. The employees I had dealt with in support were quite rude and acted as if I was the problem when I was simply trying to solve an issue on their end. Guess that's what I get for asking them to update their wallet's nodes so that their wallets aren't offline for 5 hours. 🤫

That's the problem with the person who have a big "ego". When you try to help them they think you attack them. Because they can't have done something wrong, they are the one's in charge. Sometimes they need a lesson from grey hat hacker's... keep the money in hostage disclose the vuln and send it back once they patched it... but acting like that make you a criminal.

[420 Blaze It]

Interesting, AllCrypt is glitchy anyways and the addresses are always down!

[Forezza]

Companies don't care if you report vulnerabilities to them. Unless they ask you through a disclosure program, they act like you just killed their dog. I can sort of understand it coming from the company because if someone came up to you and said "I've found a major security hole in your company and it could lead to massive losses", they generally won't be very happy about it. Companies like this think that the bugs will remain un-noticed but in reality, they won't. People with malicious purposes will find them and then they'll lose all their money.

I was in a situation when I was a bit younger where I enjoyed finding holes in large companies and reporting it to them because I thought I was doing "good". A few companies (mainly the smaller ones) were happy and noted that they would fix the issue. There was this large company once who I better not name but they absolutely lost it when I told them they had a serious vulnerability which could lead to all customer details being stolen. I said it in a way that I had just come across it and I was trying to be a good citizen and report it. They (looked like some random from the IT department) sent a message back telling me that what I was doing was totally illegal and that they had reported me to the authorities (I just laughed it off as I was sitting on an RDP -> VPN -> TOR so I wasn't too worried at the time) but the random alias email that I emailed from was disabled later that week. The most entertaining part was that they didn't even fix the security hole for 2 months after it had been reported. Quite sad for a company making millions in revenue p/week.

Most companies don't take security seriously, that's their mistake. Next time just report it under some random alias.

Allcrypt is probably one of the worst exchanges I've ever seen. They use basic PHP with very little security by the looks of it. They seem quite cocky reading https://www.allcrypt.com/blog/2014/03/po...statement/ and make sure you look at

Code

White hat hackers who want to help find holes? Don’t. You’ll be banned with the very first hit you make that doesn’t fit normal AllCrypt.com usage patterns. Again, I won’t say we’re hack proof, but we’re 10x as stringent with security now.

[Sudsy]

Damn I'm scum I guess bc I wouldn't have reported that lmao

[NoMercy]

You should have done what that white hat hacker did for BTC before. Took all the money and refuse to give it back until they fix the error.

[FaberCastell]

People don't appreciate shit nowadays,should have taken everything you could.