exlly.com HACKED #236

EXLLY · 2019-01-20T21:44:54Z

Hello

We have been the victim of add balance for Bitcoin and Litecoin in wallet of the exchange platform but no deposit for the Bitcoin or Litecoin on servers.

At all 100 Litecoin and 200 Bitcoin. We are trying to retrieve the IP address of the user.
But there was no balance for withdrawals. We lanching Exlly in 2019.

we have deactivated withdrawals and we are currently sending emails to users with real funds to withdraw them.

we will close the platform.

It is urgent to fix this problem in the source code or to warn that the code is hacked.

https://exlly.com/

sayyidkaelani · 2019-01-21T08:18:50Z

after i sent my addres on email will my fund be sent to my wallet or do you take my money away?

EXLLY · 2019-01-21T12:39:50Z

We sent you an email to return your funds yesterday. We asked you for a Bitcoin address, for your deposit, but we received an address in Litecoin. We do not "leave with the funds". We are all the more sorry about what is happening and our priority is to protect our uses of which you are a part.

jonn4y · 2019-01-21T13:06:03Z

"It is urgent to fix this problem in the source code or to warn that the code is hacked."

despite numerous security experts reviewing the code the dev still claims the code is safe, you are now the 5th exchange that I know of that has been hacked this way. funny how the only exchange that doesn't get hacked is the devs.

stay clear of opentrade, he refuses to update and fix any bugs to the public release and we have been given a list of vulnerabilities by security experts

3s3s · 2019-01-21T13:14:01Z

Nobody has shown any vulnerabilities in the published code yet.
I only see common words like: "sql injection". But no one showed an exploit.
It is difficult to catch a black cat in a dark room, especially when it is not there.

altmarkets · 2019-01-21T13:17:03Z

when what's not there?

3s3s · 2019-01-21T13:18:36Z

Where is it? Are you got an exploit or not?

sourcefinder1986 · 2019-01-21T15:07:32Z

Hi Enmanet,
I tried that what you said and it is NOT working.

sourcefinder1986 · 2019-01-21T15:26:50Z

On which platform?
I tried it myself on our system and I cannot get any increase in balance....

3s3s · 2019-01-21T15:43:44Z

Impossible.
User is locked whein closing an order
g_LockExchange[userID]['lock'] = true;
https://github.com/3s3s/opentrade/blob/master/server/modules/users/orders.js#L65

After this order amount updated to 0
await g_constants.dbTables['orders'].Update("amount='0.0', time='"+Date.now()+"'", WHERE_ORDER);
https://github.com/3s3s/opentrade/blob/master/server/modules/users/orders.js#L93

Only then user balance is updating and user is unlocked
https://github.com/3s3s/opentrade/blob/master/server/modules/users/orders.js#L106

If the user will try to close the same order again then balance will not change because
const newBalance = utils.roundDown(balance[0].balance*1 + fullAmount);
https://github.com/3s3s/opentrade/blob/master/server/modules/users/orders.js#L87

where

const fullAmount = order.buysell == 'buy' ? utils.roundDown(order.amount*order.price+g_constants.share.TRADE_COMISSION*order.amount*order.price) :
utils.roundDown(order.amount*1);

https://github.com/3s3s/opentrade/blob/master/server/modules/users/orders.js#L75

but order.amount is already 0.

sourcefinder1986 · 2019-01-21T15:49:14Z

I tried it now for half an hour and it is not possible to hack it for me.

ExchangeTime · 2019-01-21T17:15:06Z

@3s3s the problem isnt in the trading. I know how to do the glitch. Its the withdraw / coupon problem. Incase you try to withdraw high amounts etc when you dont have anything multiple times you sometimes get the amount credited to the account.

ExchangeTime · 2019-01-21T17:18:04Z

I will look into the code, but its something with the withdraw that gives you back.

If you have 0.1 btc and tries to withdraw 200 you end up with 199.9 btc on the account with no withdraw. Than you make the withdraw when you have 200 btc as normal.

3s3s · 2019-01-21T18:33:20Z

Ok, its up to you to believe it or not.

Have a nice day!

Edit:
The problem is not closing orders, its letting an attacker create multiple orders at the same time, and all are identical. Just lock opening orders once the first order is created, and set a time to wait until they can create a new one.

User is locked when adding new order here
g_LockExchange[status.id]['lock'] = true;
https://github.com/3s3s/opentrade/blob/master/server/modules/users/orders.js#L331

After that, the user balance is updated
https://github.com/3s3s/opentrade/blob/master/server/modules/users/orders.js#L336

then order inserted and only then user is unlocked
https://github.com/3s3s/opentrade/blob/master/server/modules/users/orders.js#L355

I am not see any way: how the user can place multiply orders without the balance updating (

3s3s · 2019-01-21T18:46:04Z

There are so many security vulnerabilities in OpenTrade code which needs to be fixed. Dev must update code or one have to rewrite entire code.
If dev not interested in update of code then one can fork this code ask for pull request if any has fixes.

Dev will happy to update the code if anyone will show an exploit.
So far, I only see the theoretical talk

sourcefinder1986 · 2019-01-21T18:56:42Z

i totally agree with 3s3s and i am happy that he released open trade to us and that he still works on it and comments all the questions here.

who knows if hack wasnt done from inside the vps...
because when you do transactions in the wallet via vps / daemon it shows weird balances on the exchange....

EXLLY · 2019-01-21T19:21:20Z

Hello

I have some fix for OpenTrade, to use smtp with SSL. Also there are a redirection problem for pin code or alert for mail confirmation. Support email confirmation. Email from for support. But I haven’t fix for add balance issue.
I will make pull request soon.

Thank you to all for considering this problem and working on this. It’s really important to have a good code without breach.

altmarkets · 2019-01-22T07:35:58Z

bitmxithickz do you really think we're using that exchange script - It's merely based on binance (its an exchange if you havent heard of it) the only relevance is the small featured banners at top.

The various exploits are easily due to how bloaty and bad the code is.

jonn4y · 2019-01-22T07:42:07Z

What a fucking idiot

multicoins · 2019-01-22T07:45:41Z

The various exploits are easily due to how bloaty and bad the code is.

You got exploits but you will not show it? Hmm. It is interesting...

multicoins · 2019-01-22T07:50:06Z

@ExchangeTime Have you tried coupon withdraw successfully amount more than user balance with non-admin account?

Only Admin (userid=1) can withdraw more than he got on account balance
https://github.com/3s3s/opentrade/blob/master/server/modules/users/wallet.js#L514

This is not bug. This is feature.

jonn4y · 2019-01-22T07:50:26Z

We don’t have exploits
We hired external security experts to review the code after the hack, they provided information on various vunerabilites, we deemed it more work than it’s worth to continue using opentrade and moved on to a better system

jonn4y · 2019-01-22T08:31:06Z

lol im just going to leave you here to argue with yourself if you are not smart enough to know what we are using for our exchange now then you clearly know as much as I thought you did when you told people you fixed all security issues in opentrade yet I don't see any push requests from you either.
please dont tag me in here again, github issues isnt a bitching forum its a place to post bugs

PuNkYsHuNgRy · 2019-01-22T13:40:13Z

I'm confused. I was looking into using this software. Is there an issue or not? Also if there is an issue can you point me to another backend issue free?

altmarkets · 2019-01-23T10:29:20Z

You are aware that around 10-15 exchanges have been hacked using OT, and the well aware fact that the dev has pretty made now made it closed source since since he's a 9 year old, yet you wish to use it?

3s3s · 2019-01-23T12:27:21Z

You can use OpenTrade as an exchange template only
It is very simply to install and configure the OpenTrade however, this does not mean that OpenTrade is ready to use crypto exchange for newbies.
You should closely review the code before placing it in production. You must be sure of safety your VDS servers. And of course you must be 100% sure of the integrity of your admins.

altmarkets · 2019-02-10T12:10:01Z

Discord is here, always has been https://discord.gg/GWe6N7J It wasnt via the wallet either, please do read up if you are capable of doing that - We also refunded people. Move along, please. ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐

…

On Saturday, 9 February 2019 21:25, ExchangeTime ***@***.***> wrote: I find it funny to read these chats. Both the persons from "Altmarket" behaves like children and acting in a defensive possession. They stored 3 btc / 3 btc in a hotwallet and got "hacked". They lost BTC and DOGE (the only coins with any real value). Same day as the "hack" happend they removed their discord, twitter and everything else and fucked everyone over. Atleast they could pay back everyones bitcoins they owe them. Even after all of this they choose to open a new exchange with Rubykube and people still choose to use them after deleting their social medias and pretending they are the "good" people? They havent showed 1 line of code thats "a security breach" as they are talking about. They are bullshiting so hard they even think its the "truth". Come on, who stores 100% in a hotwallet and than deletes all of their social medias when the "hack" happends. Anyone who would use Altmarket.cc i suggest to withdraw all of your coins as its a team full of scammers. — You are receiving this because you were mentioned. Reply to this email directly, [view it on GitHub](#236 (comment)), or [mute the thread](https://github.com/notifications/unsubscribe-auth/ApoOcs4YeDgEyjW2BinOKZQhJ_SzhlCIks5vLzzRgaJpZM4aJ3ae).

ExchangeTime · 2019-02-10T17:15:42Z

@altmarkets Kinda funny how you refounded coins without any value at all and same day all admins left the discord and all channels was fucked up with all connection been removed. You exit scammed and blame others.

jonn4y · 2019-02-10T17:19:27Z

how did we exit scam you fucking idiot, if we did we wouldn't be here now, we also refunded btc, doge and x42 too, no admins left the discord we are still there. believe what you want to believe and have a nice day. P.S. its refunded*

altmarkets · 2019-02-10T17:27:15Z

@altmarkets Kinda funny how you refounded coins without any value at all and same day all admins left the discord and all channels was fucked up with all connection been removed. You exit scammed and blame others.

What.

We refunded, all the TX ID's are public too, All admins were not removed - we're still online, active within the discord. Stop going on about something you clearly have no idea about, as i said - join the discord, contact us - we'll show you we have full transparency.

ExchangeTime · 2019-02-10T17:39:05Z

Great word vocabulary, using "fucking idiot". Thats a proof that you are afraid as you wouldnt have left the discord and fucked all channels up same day as it happend. Keep up with your bullshit and good luck with your 2nd scam project at same domain.

IMPERIUM-main-dev · 2019-02-25T23:23:35Z

I'm the guy as in the movies.... sitting in the corner.... seems like he's reading a newspaper.... don't see the face.... never say a word...... but listens.

ghost · 2019-02-25T23:25:43Z

And i'm his brother. Drunk. At the bar.

ghost · 2019-02-25T23:28:04Z

let's see what happens with altmarkets.io this time........ altmarkets.cc listed me for 3 days and I paid a bit but still..... I really would like to hope we were wrong. But I just can't believe it.

ghost · 2019-02-25T23:29:01Z

Because I asked them to list my new coin, and they insulted me.

altmarkets · 2019-02-25T23:29:52Z

We're the normal people - above you. Thinking, he's back look.

ghost · 2019-02-25T23:30:17Z

lollll

ghost · 2019-02-25T23:30:41Z

yeah I should retire

ghost · 2019-02-25T23:31:18Z

and play pokemon

altmarkets · 2019-02-26T05:29:17Z

People do realise that your talking to yourself right, you need to look into that. It's an issue. People know LightningCash and Imerium are from the same 'developer'.

You paid $35 to list a coin (which is no longer functional) , that was via .cc also we refused to list your new coin - you also pretended to be "CIA" - need to grow up a little and move along.

Firoz81 · 2019-04-25T02:09:47Z

Hi, @jonn4y @altmarkets,

I want to start my own crypto exchange, I gave a try on opentrade and I guess it's easy to set up. but this hack things and vulnerabilities in code maybe big issue. You guys said opentrade code has security vulnerabilities but you did not revealed where, also did not explore your hack story how exactly it was hacked? I know you opentrade guys are intelligent and honest while we all here are idiots but if you explain what exactly happen dev may fix that bug and this code maybe usable for all.
I know you guys are code geeks even smarter than opentrade dev but we would like to know how exchange was hacked so we can work on code to fix.

You guys are hard coders and 3s3s is noob but please let all know how exchange was hacked and help 3s3s fix bugs you found or your external experts who also must be more smarter and intelligent than you.
So kindly explore how hacker hacked?

Thank You.

picscoin · 2019-08-22T23:48:25Z

What are you stupid or something? is this thing hackable ? I am about to dos the entire universe! Can u haz my bitcoin or what? It's not like someone deleting all teamspeak channels or anything like that would mean consipiracy or abuse from staff? So are staff compliant or no?

picscoin · 2019-08-22T23:49:44Z

Where is the sql portion is this thing needing sql or not? how can sql injection?

bitmxittz mentioned this issue Jan 22, 2019

hack !!! https://altmarkets.cc/announce #207

Open

knkrth mentioned this issue Jan 22, 2019

Hack proof #235

Closed

3s3s closed this as completed Jan 23, 2019

exlly.com HACKED #236

exlly.com HACKED #236

Comments

EXLLY commented Jan 20, 2019

sayyidkaelani commented Jan 21, 2019

EXLLY commented Jan 21, 2019

jonn4y commented Jan 21, 2019

3s3s commented Jan 21, 2019

altmarkets commented Jan 21, 2019

3s3s commented Jan 21, 2019

sourcefinder1986 commented Jan 21, 2019

sourcefinder1986 commented Jan 21, 2019

3s3s commented Jan 21, 2019 • edited Loading

sourcefinder1986 commented Jan 21, 2019

ExchangeTime commented Jan 21, 2019

ExchangeTime commented Jan 21, 2019

3s3s commented Jan 21, 2019 • edited Loading

3s3s commented Jan 21, 2019 • edited Loading

sourcefinder1986 commented Jan 21, 2019 • edited Loading

EXLLY commented Jan 21, 2019 • edited Loading

altmarkets commented Jan 22, 2019

jonn4y commented Jan 22, 2019

multicoins commented Jan 22, 2019

multicoins commented Jan 22, 2019

jonn4y commented Jan 22, 2019

jonn4y commented Jan 22, 2019

PuNkYsHuNgRy commented Jan 22, 2019 • edited Loading

altmarkets commented Jan 23, 2019

3s3s commented Jan 23, 2019 • edited Loading

altmarkets commented Feb 10, 2019 via email • edited Loading

ExchangeTime commented Feb 10, 2019

jonn4y commented Feb 10, 2019

altmarkets commented Feb 10, 2019

ExchangeTime commented Feb 10, 2019

IMPERIUM-main-dev commented Feb 25, 2019

ghost commented Feb 25, 2019

ghost commented Feb 25, 2019

ghost commented Feb 25, 2019

altmarkets commented Feb 25, 2019

ghost commented Feb 25, 2019

ghost commented Feb 25, 2019

ghost commented Feb 25, 2019

altmarkets commented Feb 26, 2019

Firoz81 commented Apr 25, 2019

picscoin commented Aug 22, 2019

picscoin commented Aug 22, 2019

3s3s commented Jan 21, 2019 •

edited

Loading

3s3s commented Jan 21, 2019 •

edited

Loading

3s3s commented Jan 21, 2019 •

edited

Loading

sourcefinder1986 commented Jan 21, 2019 •

edited

Loading

EXLLY commented Jan 21, 2019 •

edited

Loading

PuNkYsHuNgRy commented Jan 22, 2019 •

edited

Loading

3s3s commented Jan 23, 2019 •

edited

Loading

altmarkets commented Feb 10, 2019 via email •

edited

Loading