While setting up the blackjack script on the Omnicoin casino, I went in to check on the dice script. While doing so I noticed that some of the balance stats didn't seem quite right. The user account balance was a negative amount. After running some quick queries on the database, I found that there were multiple accounts with negative balances. I figured someone found a way to withdraw more than was in their account. A quick check to the logs confirmed this.
After doing some investigation, I've determined that over the course of the past month, someone has siphoned off 22,747.01821024 OMC from the wallet. Since the attacker didn't fully empty the wallet each time, the account balances didn't go ever negative and so I never suspected an issue, until yesterday.
I had a bad feeling about running a 3rd party script like this, but I just hoped for the best. I should have taken the use of functions 3 years+ deprecated and the horrible code as a warning that the script shouldn't be trusted, but instead I just updated the obvious things and went with it.
I won't be running a third party script like this ever again. Especially not one with this bad of a reputation. I'll be spending the new few days creating a new provably fair blackjack game. I'm not going to trust the current one, even though I haven't had an issue yet. I'm not sure what I'll do about the dice game. I might remake it, I might not. It depends on if anyone wants to play it.
The 23K OMC will be coming from my pocket. No one else will lose anything. I'll set something up so you can claim any deposits you had. This doesn't effect the pool or online wallet. Those are completely different systems running in isolated environments.
I've got quite a few IPs and addresses that I can look into, but I doubt I'll find anything to link me back to the attacker. It was probably someone from this community though. It's sad, but that's the way the game goes.
Lastly I want to give a thanks to the users who have donated to help cover the stolen funds:
$10 BTC - bloodhawkbh
1,000 OMC - Justin Timberlake
After doing some investigation, I've determined that over the course of the past month, someone has siphoned off 22,747.01821024 OMC from the wallet. Since the attacker didn't fully empty the wallet each time, the account balances didn't go ever negative and so I never suspected an issue, until yesterday.
I had a bad feeling about running a 3rd party script like this, but I just hoped for the best. I should have taken the use of functions 3 years+ deprecated and the horrible code as a warning that the script shouldn't be trusted, but instead I just updated the obvious things and went with it.
I won't be running a third party script like this ever again. Especially not one with this bad of a reputation. I'll be spending the new few days creating a new provably fair blackjack game. I'm not going to trust the current one, even though I haven't had an issue yet. I'm not sure what I'll do about the dice game. I might remake it, I might not. It depends on if anyone wants to play it.
The 23K OMC will be coming from my pocket. No one else will lose anything. I'll set something up so you can claim any deposits you had. This doesn't effect the pool or online wallet. Those are completely different systems running in isolated environments.
I've got quite a few IPs and addresses that I can look into, but I doubt I'll find anything to link me back to the attacker. It was probably someone from this community though. It's sad, but that's the way the game goes.
Lastly I want to give a thanks to the users who have donated to help cover the stolen funds:
$10 BTC - bloodhawkbh
1,000 OMC - Justin Timberlake
