hi :3 i was the one who did it. funny thing i reported stuffs to freebitcoin previously and they ignored it. actually multiple people knew the exploits and was also reported. i waited time to do this and wonder if they still care. i guess not? if you wonder where is the money of those people, i gambled it for those people and blew it all up. its also funny to see people are depositing on a website that has very high house edge. there are alternatives that you can use that has better edge + better support that actually cares for the people.
No way you orchestrated such a high-profile heist like this just to send a message about FBC's house edge. What's the motivation, really?
i just hate fbc. this wouldnt happen if they actually care for the customers. the website is filled with xss exploits and they know it but they just didnt fix it.
How long would you say the XSS vulnerability was in the site for? Crazy to think it was there all this time until you exploited it proper.
Idk but i saw the xss vulnerability like a year ago. I believe it existed it for alot of years since they added a specific system that i wont mention. there are also multiple other xss that existed for long that hasnt been fixed
Interesting. So what critical information could you parse with this xss exploit from the victim's FBC account that you could use for monetary gain? Besides, y'know, scaring them shitless with a message telling them to transfer half a BTC or else.
I'm actually pretty impressed they saw through that bullshit message, by the way. Tracked down the malicious js and blocked, even. How much money did you steal with the address switcheroo?