Quote from: fluffypony on October 18, 2016, 09:49:09 AM

Quote from: Jungian on October 18, 2016, 09:42:57 AM

Quote from: fluffypony on October 18, 2016, 09:33:22 AM

Custom API, so I don't think this affects anyone else. We've disabled betting in the meantime whilst we sort this out, but I really think the lesson to other operators is not to be overconfident in your code or in your setup. Everything can and will be compromised, so assume it's going to happen and put safeguards in place to handle that eventual scenario.

Do you think it could have been compromised a long time ago? Maybe the hacker got tired of milking it and just went for a big score.

It's entirely possible, but one of the Monero Research Lab wrote a paper (for fun) a year ago establishing a way to analyse whether someone is cheating by determining whether they are massively changing the deviation of the site.

We run this analysis in the back all the time, so if someone was consistently cheating, even if they were using multiple accounts and small amounts, we'd see it show up because the site would (statistically speaking) be far out of the expected variance.

You can read the paper here: https://lab.getmonero.org/pubs/MRL_Monte_Carlo_Edition.pdf

Even with small amounts? imagine if he were doing 2 losses for every win, but, every win he bets 3~5 times the lose value.
statistically, this wouldnt be almost impossible to find and with small amount it would be even harder.. any way, everything on internet have vulnerabilities.