First, the background:
August 26, 2016: Reports of leaked BTC-e accounts being attacked.
September 1, 2016: Leakedsource.com lists BTC-e and Bitcointalk accounts as available to hackers
https://www.hackread.com/hacked-bitcointalk-forum-database-on-dark-web/
November 20, 2016: 2plus2 forum hacked
https://www.pokernews.com/news/2017/01/twoplustwo-discovers-user-database-hack-jan-8-26740.htm
December 24 2016: Betking.io hack hacked
December 27 2016 - January 9 2017: Whale accounts login and withdraw.
Whoever the person was that withdrew had the account details. The account emails were all present in one or more of the btc-e, 2plus2 and betking.io hacks mentioned above.
February-March 2017: 2fa implemented and whale accounts reimbursed plus the profit from their investments.
Regarding the 300 BTC Slot game win
January 11, 2017,The player Underdog01253 (https://www.satoshidice.com/user/ed10cec930365a1af6db2225843f6e36) made a large win on the slot game. People have been wondering how such a large win could be allowed from the bankroll. The max bet amount on the slot game is not dynamic as on the dice, it has to be done manually. The slot game has many paylines, it doesn't really work well if the bet sizes on the slot game would be in increments of 14.235, 18.503, 26.322 instead of 10, 15, 25 ect.
With the Bitcoin price increasing rapidly and many users withdrawing from the bankroll, the Slot game ended up allowing relatively large wagers. Overall, Satoshidice paid out more than the expected value to investors since the start, meaning that the bets actually generated more to investors than the expected outcome.
To answer Game-Protect points directly:
The below time line gives more detail to game protects analysis.
August 26, 2016: Reports of leaked BTC-e accounts being attacked.
September 1, 2016: Leakedsource.com lists BTC-e and Bitcointalk accounts as available to hackers
https://www.hackread.com/hacked-bitcointalk-forum-database-on-dark-web/
November 20, 2016: 2plus2 forum hacked
https://www.pokernews.com/news/2017/01/twoplustwo-discovers-user-database-hack-jan-8-26740.htm
December 24 2016: Betking.io hack hacked
December 27 2016 - January 9 2017: 4 Investor accounts login and withdraw.
Whoever the person was that withdrew had the account details. The account emails were all present in one or more of the btc-e, 2plus2 and betking.io hacks mentioned above.
We got one report of a user who clicked a Bitcointalk phishing link, entered his information and then got his balance stolen on Satoshidice.
We have seen attempts of password guessing on what appears to be big lists of emails. We do not store password in clear text in the database but we looked at real-time password attempts and there thousands of login attempts made with different emails and password "password". All those IP addresses are blocked and stored for future evidence.
It was was the description that should have been updated, not the Terms & Conditions as agreed to when a user creates an account.
Long term backers affected by the big Slot win were also affected positively overall.
We of course took responsibility for the lack of 2fa on player accounts and reimbursed the 4 investors (including their profits) and players that were impacted by the lack of 2fa.
2FA was then implemented with additional security measures
The long term backers affected by the big slot win were affected positively by the slot bets before and after the big win:
Overall, SatoshiSlot has given over 150 BTC to backers.
August 26, 2016: Reports of leaked BTC-e accounts being attacked.
September 1, 2016: Leakedsource.com lists BTC-e and Bitcointalk accounts as available to hackers
https://www.hackread.com/hacked-bitcointalk-forum-database-on-dark-web/
November 20, 2016: 2plus2 forum hacked
https://www.pokernews.com/news/2017/01/twoplustwo-discovers-user-database-hack-jan-8-26740.htm
Quote
TwoPlusTwos user database at forumserver.twoplustwo.com was recently compromised, according to an email from TwoPlusTwo management sent to users Jan. 9. The hack was discovered Jan. 8.
December 24 2016: Betking.io hack hacked
Quote
The attacker had complete access to the database. This means he could have seen player dice seeds, balances, email addresses, emergency withdrawal addresses, IP addresses and two factor authentication backup codes.
December 27 2016 - January 9 2017: Whale accounts login and withdraw.
Whoever the person was that withdrew had the account details. The account emails were all present in one or more of the btc-e, 2plus2 and betking.io hacks mentioned above.
February-March 2017: 2fa implemented and whale accounts reimbursed plus the profit from their investments.
Regarding the 300 BTC Slot game win
January 11, 2017,The player Underdog01253 (https://www.satoshidice.com/user/ed10cec930365a1af6db2225843f6e36) made a large win on the slot game. People have been wondering how such a large win could be allowed from the bankroll. The max bet amount on the slot game is not dynamic as on the dice, it has to be done manually. The slot game has many paylines, it doesn't really work well if the bet sizes on the slot game would be in increments of 14.235, 18.503, 26.322 instead of 10, 15, 25 ect.
With the Bitcoin price increasing rapidly and many users withdrawing from the bankroll, the Slot game ended up allowing relatively large wagers. Overall, Satoshidice paid out more than the expected value to investors since the start, meaning that the bets actually generated more to investors than the expected outcome.
To answer Game-Protect points directly:
Quote
1) Bitcoin hot wallet is almost always empty since December 2016.
For security reasons it advisable not to have a large sum of coins in a hot wallet. When the hot wallet needs funds we have to manually transfer coins from our cold storage. Because of this and the increase in withdrawals due to the btc price increase and naturally investors wishing to take advantage of this.Quote
2) Dice game investor account balances in the height of minimum around 200+ Bitcoins magically disappeared and were instantly withdrawn.
This was due to a combination of factors. The 4 investors were connected albeit coincidentally by the following. All compromised account emails were present in one or more of the btc-e, 2plus2 and betking.io hacks. The below time line gives more detail to game protects analysis.
August 26, 2016: Reports of leaked BTC-e accounts being attacked.
September 1, 2016: Leakedsource.com lists BTC-e and Bitcointalk accounts as available to hackers
https://www.hackread.com/hacked-bitcointalk-forum-database-on-dark-web/
November 20, 2016: 2plus2 forum hacked
https://www.pokernews.com/news/2017/01/twoplustwo-discovers-user-database-hack-jan-8-26740.htm
Quote
TwoPlusTwos user database at forumserver.twoplustwo.com was recently compromised, according to an email from TwoPlusTwo management sent to users Jan. 9. The hack was discovered Jan. 8.
December 24 2016: Betking.io hack hacked
Quote
The attacker had complete access to the database. This means he could have seen player dice seeds, balances, email addresses, emergency withdrawal addresses, IP addresses and two factor authentication backup codes.
December 27 2016 - January 9 2017: 4 Investor accounts login and withdraw.
Whoever the person was that withdrew had the account details. The account emails were all present in one or more of the btc-e, 2plus2 and betking.io hacks mentioned above.
Quote
3) Satoshidice scam server administrator is not able to check if gaming server was compromised, even though every second of what happened is (should be) recorded! The site has no 2 factor authentification, a very basic standart for Bitcoin exchanger and their server probably do not fulfil very basic security standarts as well!
There is no evidence of the servers being compromised. Part of the work is to exclude that the accounts in question simply made a withdrawal and then stated that they didn't make the withdrawal.We got one report of a user who clicked a Bitcointalk phishing link, entered his information and then got his balance stolen on Satoshidice.
We have seen attempts of password guessing on what appears to be big lists of emails. We do not store password in clear text in the database but we looked at real-time password attempts and there thousands of login attempts made with different emails and password "password". All those IP addresses are blocked and stored for future evidence.
Quote
4) January 11, 2017, the account Underdog01253 was created, placed a 0.25 BTC ($250!) slot bet and won a x1215.92 multiplier to walk away with a whopping 303.73 BTC!
There is a large bet history for the user Underdog01253. The user continued to play and lost ~3/4 of their winningsQuote
5) The 303.73 BTC slot win was reduced from Satoshi Dice investor account balances, even though the Bet on the house terms and conditions clearly state that investors only invest in the Satoshi Dice game
We did not update our description on the Bet on the House tab when we added the Satoshi Slot game to the site. This was an error, of course on our part. However, it is worth noting:It was was the description that should have been updated, not the Terms & Conditions as agreed to when a user creates an account.
Long term backers affected by the big Slot win were also affected positively overall.
We of course took responsibility for the lack of 2fa on player accounts and reimbursed the 4 investors (including their profits) and players that were impacted by the lack of 2fa.
2FA was then implemented with additional security measures
The long term backers affected by the big slot win were affected positively by the slot bets before and after the big win:
Overall, SatoshiSlot has given over 150 BTC to backers.