hi :3 i was the one who did it. funny thing i reported stuffs to freebitcoin previously and they ignored it. actually multiple people knew the exploits and was also reported. i waited time to do this and wonder if they still care. i guess not? if you wonder where is the money of those people, i gambled it for those people and blew it all up. its also funny to see people are depositing on a website that has very high house edge. there are alternatives that you can use that has better edge + better support that actually cares for the people.
No way you orchestrated such a high-profile heist like this just to send a message about FBC's house edge. What's the motivation, really?
i just hate fbc. this wouldnt happen if they actually care for the customers. the website is filled with xss exploits and they know it but they just didnt fix it.
How long would you say the XSS vulnerability was in the site for? Crazy to think it was there all this time until you exploited it proper.
Idk but i saw the xss vulnerability like a year ago. I believe it existed it for alot of years since they added a specific system that i wont mention. there are also multiple other xss that existed for long that hasnt been fixed
Interesting. So what critical information could you parse with this xss exploit from the victim's FBC account that you could use for monetary gain? Besides, y'know, scaring them shitless with a message telling them to transfer half a BTC or else.
I'm actually pretty impressed they saw through that bullshit message, by the way. Tracked down the malicious js and blocked it, even. How much BTC did you steal with the address switcheroo?
i can setup a convincing login page or a verification page but there is no point, if i cant access their email since email requires additional securities these days. the scare message was my desperate attempt to get my final btc because i got into a debt problem after gambling other users money and decided to deposit my own money and borrowed some after losing it all.
i stole 1.3-1.4 in total. Zibi321 could have gotten 9btc in return from my gambling session since i felt bad for him but he decided to lie and ghost me. His money is still on fbc and if only fbc is kind enough to give it back since i spent his balance there.