ACR player claims a withdrawal was made without his permission. PFA is on the case...

https://twitter.com/_WasAllADream/st...89175167340545
https://twitter.com/_WasAllADream/st...89179126751243
https://twitter.com/_WasAllADream/st...89183048396800
https://twitter.com/_WasAllADream/st...89185711812621
https://twitter.com/_WasAllADream/st...15359385411586
https://twitter.com/_WasAllADream/st...11729991241732


:what


Cliffs:

- Guy notices withdrawal was made from his ACR account

- Went to his e-mail, saw nobody logged in but him

- There were indeed withdrawal e-mails, but he claims he never saw them nor clicked them prior to being processed

- Email said that a new device logged into his ACR account, needing a click for verification to access, which he also never clicked

This occurred on March 13.

I am in the process of talking to the guy privately, and will report back what I can. I will ask his permission before revealing anything sensitive or detailed.

How much did they get him for?

Quote:

---

Originally Posted by FRANKRIZZO

How much did they get him for?

---

Wanted to make sure it was okay with him to post this, but he said it was fine.

They got him for almost $9k.

It appears it was NOT an inside job from his house.

Someone went onto ACR with a device the system hadn't seen before, and somehow got into his e-mail to click the link to authorize the new device, and then did the withdrawal.

I sent him to ask ACR support the following:

1) What kind of withdrawal was it? If crypto, what was the address?

2) What was the IP of the device requesting the withdrawal?

3) What was the type of device making the withdrawal, and has it been seen before on ACR?


If they answer, I will be able to go from there to figure out what happened. If they refuse, I can reach out to some contacts to get them to tell him this stuff. It's his right to know.

He ran a Windows Defender and Malwarebytes scan on his computer (the latter at my request), and nothing malicious was found.

Mystery so far, but I'm very curious to figure it out.

Well, this whole thing took a bizarre turn, and now I'm seriously starting to think that this WAS an inside job at ACR.

It all started when I messaged the guy tonight, shortly before radio, that I was wondering if he had any updates for me. I hadn't heard from him in the 3 1/2 days since we first discussed this.

Four hours later, at 12:30am, he responded while I was on radio. I offered him to come on the show, but he said he was tired, and politely declined. Brandon was on radio with me at the time, and noted that it seemed weird that the guy couldn't see if it was a crypto withdrawal, because Brandon plays there and this info always shows for him.

I asked the guy via Twitter DM if he could check again if he could see the type of withdrawal it was.

This prompted the guy to go log into his ACR account for the first time in several days, to see if he was perhaps missing something.

Instead, he found that the entire withdrawal had been restored to his account, and his balance was back over $9k!

He was shocked to see this, especially because ACR had never e-mailed him that they did this, nor had they answered his recent questions regarding the IP address of the person initiating the withdrawal from his account.

He then sent me this screen shot (zoom in to see it).




The reason was "Fraud", Payment method was "Sec-Reimbursement" (presumably "Security Reimbursement"), and the descirption was "Reintegration due to breaching incident".

Breaching incident?! That sounds like it was something on ACR's end.

I find it highly unlikely that ACR would have credited this guy over $8800 out of their own pockets if the "breach" had been due to his own inability to keep his account or computer secure!

This looks like security discovered that indeed this was an inside job ("breaching incident"), so they kicked the guy back his money.

Another player claimed on March 23 that the exact same thing happened to him:

https://twitter.com/C4NKL3S/status/1506798764580868102



I have a feeling that there are some thieves working behind the scenes at ACR, and they are aware of it, but don't want it known, for optics reasons.

What the hell is going on here?! Zero chance this guy got a credit of almost $9k just because ACR felt like being nice after someone hacked him. When I first read this story, I figured the problem was on his end. Now I think there's a high chance ACR is having security issues with their accounts.

Developing...

At least the thief was kind enough to leave him $216. I wonder why they didn’t take every last dollar?

Quote:

---

Originally Posted by PositiveVariance

At least the thief was kind enough to leave him $216. I wonder why they didn’t take every last dollar?

---

I theorized on radio (to be posted later) that maybe ACR has some kind of internal check for withdrawals over $9k, so they keep them below that number.

I'll find out how much they pulled from the other guy.

it was north koreans and im actually not joking.

Another player hit back in late January.

Same story -- he complained, and got his money back 17 days later.

This one was for about $14k.

I edited the images of the payouts and the money return so they better fit on the screen of this forum, and also redacted transaction numbers. However, these all look legit to me, as I have the original screen shots. Zoom in to see better.

moneymaker claims he talked to you and said it’s not an inside job. As I said over there if it’s not an inside job then players need to run and pull money off ACR because their whole financial system has been compromised clearly. Personally I think Moneymaker is drinking Nagys Koolaide and he’s accepting the crap being told to him.

New reports of this keep rolling into my Twitter DMs every day, and all of them seem credible.

All of them involve amounts $9k-$20k, with the exception of one bizarre situation where a guy deposited $247 and it was promptly withdrawn and stolen. (Oddly they didn't touch the original $68 he had in the account prior to the deposit.)

All of them have very similar circumstances -- no password change, no breach in e-mail, and no sign anything's wrong. Suddenly a withdrawal is made via bitcoin, and they're out the money.

In some cases, a refund was made. In others, no refund was done yet, but the process of investigation tends to take 2-3 weeks, from what I've seen.

No explanation is ever given when the money is refunded. ACR refuses to give anyone the IP address or bitcoin address of the person making the fraudulent withdrawals. They just ignore these requests.

Very high chance at this point that an insider is doing this. I don't believe management is in on it, but I know 100% they're aware of it, as I had the message passed to Nagy himself that this is going on.

It is highly suspicious that ACR is both refunding these large amounts to some people (why would they if it's the players' fault), as well as the fact that ACR will not provide the IP/bitcoin address info. I think they're trying to internally stop this before the story gets out.

The earliest known instance of this was on January 26th. The latest known incident was April 3.

Regarding all the ACR conspiracy stuff (including Chicago Joey's disappearance from social media), let's keep that off this thread.

I moved it to a separate thread: https://pokerfraudalert.com/forum/sh...2-also-own-ACR

Let's stick to what's definitely happening here:

People are having their accounts breached and withdrawals made, but their passwords are never changed and their e-mail is never compromised. At least two of them have been reimbursed large sums of money -- something unlikely to happen if this wasn't an inside job.

I didn't hear about any of this prior to January 26, 2022. Now it's happening to a ton of unrelated people.

Something is going on here. I don't believe management is involved. My theory is that one or more rogue employees have a way to get into accounts without having to know the password (or, alternately, can see the passwords somehow).

I will continue to investigate this. I am talking to several people right now who claim to be victims of this, and they all seem credible.

Quote:

---

Originally Posted by Dan Druff

Regarding all the ACR conspiracy stuff (including Chicago Joey's disappearance from social media), let's keep that off this thread.

I moved it to a separate thread: https://pokerfraudalert.com/forum/sh...2-also-own-ACR

Let's stick to what's definitely happening here:

People are having their accounts breached and withdrawals made, but their passwords are never changed and their e-mail is never compromised. At least two of them have been reimbursed large sums of money -- something unlikely to happen if this wasn't an inside job.

I didn't hear about any of this prior to January 26, 2022. Now it's happening to a ton of unrelated people.

Something is going on here. I don't believe management is involved. My theory is that one or more rogue employees have a way to get into accounts without having to know the password (or, alternately, can see the passwords somehow).

I will continue to investigate this. I am talking to several people right now who claim to be victims of this, and they all seem credible.

---

Seriously Todd what has Moneymaker said you saw the tweet he sent me last week. He claimed it wasn’t an inside job and he claimed he talked to you about the whole thing. I’m guessing he lied

Edit: I maybe willing to cut CM a little slack only because I think he’s being fed a bunch of shit from Phil Nagy himself. Moneymaker is drinking the koolaid Nagy is serving clearly in that he’s still claiming it’s not an inside job. If it is then Nagy is covering it up (highly likely) and is going to make Moneymaker look like a fool which is sad. If it is true that it’s not an inside job then again this is a major security breech of the sites financial system and players should run away quickly. I get there’s not a lot of options but if your leaving funds on ACR well aware funds are being stolen from off the site then I don’t know what to tell ya.

Quote:

---

Originally Posted by Dan Druff

New reports of this keep rolling into my Twitter DMs every day, and all of them seem credible.

All of them involve amounts $9k-$20k, with the exception of one bizarre situation where a guy deposited $247 and it was promptly withdrawn and stolen. (Oddly they didn't touch the original $68 he had in the account prior to the deposit.)

All of them have very similar circumstances -- no password change, no breach in e-mail, and no sign anything's wrong. Suddenly a withdrawal is made via bitcoin, and they're out the money.

In some cases, a refund was made. In others, no refund was done yet, but the process of investigation tends to take 2-3 weeks, from what I've seen.

No explanation is ever given when the money is refunded. ACR refuses to give anyone the IP address or bitcoin address of the person making the fraudulent withdrawals. They just ignore these requests.

Very high chance at this point that an insider is doing this. I don't believe management is in on it, but I know 100% they're aware of it, as I had the message passed to Nagy himself that this is going on.

It is highly suspicious that ACR is both refunding these large amounts to some people (why would they if it's the players' fault), as well as the fact that ACR will not provide the IP/bitcoin address info. I think they're trying to internally stop this before the story gets out.

The earliest known instance of this was on January 26th. The latest known incident was April 3.

---

I realize that you have Moneymaker's ear but have you tried contacting Randy Nanonoko Lew, who is the "security consultant" for ACR? He seems nice, maybe get him on the radio, would be a good listen

AMERICAS CARDROOM WELCOMES RANDY LEW - AYO.NEWS
https://ayo.news/2020/12/30/acr-randy-lew
Dec 30, 2020 · US-facing poker site, Americas Cardroom (ACR), has hired Randy “Nanonoko” Lew as Security Consultant and Gameplay Expert.

https://www.prnewswire.com/news-rele...301198350.html

Quote:

---

Originally Posted by JoeD

Quote:

---

Originally Posted by Dan Druff

New reports of this keep rolling into my Twitter DMs every day, and all of them seem credible.

All of them involve amounts $9k-$20k, with the exception of one bizarre situation where a guy deposited $247 and it was promptly withdrawn and stolen. (Oddly they didn't touch the original $68 he had in the account prior to the deposit.)

All of them have very similar circumstances -- no password change, no breach in e-mail, and no sign anything's wrong. Suddenly a withdrawal is made via bitcoin, and they're out the money.

In some cases, a refund was made. In others, no refund was done yet, but the process of investigation tends to take 2-3 weeks, from what I've seen.

No explanation is ever given when the money is refunded. ACR refuses to give anyone the IP address or bitcoin address of the person making the fraudulent withdrawals. They just ignore these requests.

Very high chance at this point that an insider is doing this. I don't believe management is in on it, but I know 100% they're aware of it, as I had the message passed to Nagy himself that this is going on.

It is highly suspicious that ACR is both refunding these large amounts to some people (why would they if it's the players' fault), as well as the fact that ACR will not provide the IP/bitcoin address info. I think they're trying to internally stop this before the story gets out.

The earliest known instance of this was on January 26th. The latest known incident was April 3.

---

I realize that you have Moneymaker's ear but have you tried contacting Randy Nanonoko Lew, who is the "security consultant" for ACR? He seems nice, maybe get him on the radio, would be a good listen

AMERICAS CARDROOM WELCOMES RANDY LEW - AYO.NEWS
https://ayo.news/2020/12/30/acr-randy-lew
Dec 30, 2020 · US-facing poker site, Americas Cardroom (ACR), has hired Randy “Nanonoko” Lew as Security Consultant and Gameplay Expert.

https://www.prnewswire.com/news-rele...301198350.html

---

Yikes if Randy isn’t careful he’s gonna be made the scapegoat by Phil Nagy I’m betting. He hasn’t been on Twitter much himself it appears only a handful of tweets since the holidays.

This is some serious shit going on and the CEO Nagy or somebody needs to explain it and quick. Ive played on ACR and still do sometimes and right now Im about to pull my funds off the site until this is resolved. Im not a huge fan of Bodog/Ignition honestly but there issues have been minor outside of the shadiness they pulled on poor Tradersky. This seems to be outright theft of players funds.. Has anybody suggested to get the illustrious Haley Hintze involved to investigate this and turn on the lights and expose the cockroachs before they scatter everywhere. Im sure Phil Nagy knows whats going on and I have to agree either issue is disturbing either he has thieves working for him somewhere or theyve been hacked and cant figure out how its happening. Given the known previous software issues its very possible its the case. Maybe just maybe somebody left a backdoor in there somewhere in the software (would not be the first time its happened). Guess time will tell. In the meantime its time to turn the heat up on ACR to force them to answer to this before somebody does serious damage and takes down the whole site like happened to Lock only this time itll be outright thievery and not just people spending money. ACR cant keep covering these losses if theyre continueing forever and eventually either way somebodys going to end game this shit like happened in that one movie Hackers years ago instead of a cargo ship itll be ACR being cleaned out by either the insiders doing this or the outside hackers if thats the case potentially.

I've been hammering them hard on Twitter for the past few days.

Now we're finally getting somewhere!

https://twitter.com/ACR_POKER/status...09972620029959

A "credential stuffing attack" is where hackers who breached other sites' databases attempt to use those same e-mail/password combos to access more sites.

BTW, their explanation doesn't make sense, because the first victim clearly had no logins in his e-mail to verify the new device logging in to ACR, yet the verification link was clicked. A "credential stuffing attack" would not have allowed this if his e-mail wasn't breached.

Looks like a cover-up to me. I'm pressing for more details.

Quote:

---

Originally Posted by Dan Druff

A "credential stuffing attack" is where hackers who breached other sites' databases attempt to use those same e-mail/password combos to access more sites.

BTW, their explanation doesn't make sense, because the first victim clearly had no logins in his e-mail to verify the new device logging in to ACR, yet the verification link was clicked. A "credential stuffing attack" would not have allowed this if his e-mail wasn't breached.

Looks like a cover-up to me. I'm pressing for more details.

---

Its all bullshit on ACRs part and bad news for them. Now this is spreading on twitter. Jess Welman has commented (although she didnt say much other then her usual US players shouldnt play off shore but again what choices do US players have Jess seriously 5 states are up and running Online poker none of which have any real momentum without larger player pools) and now a smaller poker journalism site has posted an article mostly based on the postings from PFA.

One of the victims attempted to ask for the IP address and the BTC address of the person who made the unauthorized withdrawal.

It should be his right to know where his money went, right? Keep in mind he hasn't been reimbursed yet.

Here's the response he got today:






Why is ACR hiding the IP address and the bitcoin withdrawal address of the hackers who stole the money from their users?

Who are they protecting, and why?

Why not let the community see these,so we can work to identify the thieves?

Or, perhaps... would they rather we don't identify these people, because it will reveal something they don't want people to see?

Quote:

---

Originally Posted by Dan Druff

One of the victims attempted to ask for the IP address and the BTC address of the person who made the unauthorized withdrawal.

It should be his right to know where his money went, right? Keep in mind he hasn't been reimbursed yet.

Here's the response he got today:






Why is ACR hiding the IP address and the bitcoin withdrawal address of the hackers who stole the money from their users?

Who are they protecting, and why?

Why not let the community see these,so we can work to identify the thieves?

Or, perhaps... would they rather we don't identify these people, because it will reveal something they don't want people to see?

---

Not jumping on the conspiracy theory crap of anybody but I’m curious if this is indeed an inside job if there isn’t some borrowing going on and question is are they using incoming deposits to cover these losses. I’m just wondering if there isn’t a shit ton more to this then we even know.

In what may or may not be related, the mobile app has been down all day, and it's not clear what is going on.

https://twitter.com/ZippyChippy4/sta...17919765618689

https://twitter.com/ACR_POKER/status...61623347564554



It is very possible that ACR discovered that this breach was via the mobile app, and they've taken it offline until they can fix it. Note in the e-mail posted by that Twitter user above, ACR acknowledges there is "no timetable" for the mobile app's return.


There are also several (reliable) reports of a new procedure in place over the past week, regarding sending a confirmation e-mail to cashier@digitalexchange.eu, when a cashout is requested. I am assuming that digitalexchange.eu is their payment processor.

I doubt this is all a coincidence, and I believe the situation is a lot more complex than a simple "credential stuff" attack.

I suppose this is a good time to give a summary of everything going on, and why I feel ACR's "credential stuffing attack" story is BS.


https://twitter.com/ACR_POKER/status...09972620029959


What is a "credential stuffing attack"?

A "credential stuffing attack" sounds like something very technical and complicated, but it's actually quite simple. In recent years, huge databases full of e-mails and passwords have been hacked, and sold/shared on the black market. Therefore, if you use the same e-mail and password combination on multiple sites, these hackers can access all of your accounts using such a combo, no matter how "tough" your password would be to guess.

Credential stuffing attacks are not done by human beings. They are done by automated bots, which try thousands or millions of e-mail/password combos obtained from other site hacks. The bots do not try to make additional guesses. For example, if you used the simple password "Bobby1" on website A, and "Bobby2" on website B, the bot would NOT be able to break into your account on site B, despite the similarity of the two passwords. It would try "Bobby1" on website B, fail to login, and move on to the next account. However, if you used password "23nFW#2b%12$!" on BOTH sites A and B, with the same e-mail or login name, then the credential stuffing attack WOULD work.



What is ACR claiming occurred?

ACR seems to be stating that a credential stuffing attack was used on their service, where hacks of other sites yielded e-mail/password combos which were also used on ACR. They claim this allowed the hackers to get into accounts, and make these unauthorized withdrawals.

ACR claims that they have refunded all affected players. While I have seen evidence that some players have received refunds, others are still waiting for resolution. It should also be noted that they only seem to be refunded those who noticed the money missing.



What is the problem with ACR's explanation?

Anyone attempting to login to ACR's platform using a different device would get a "new device" confirmation e-mail. Until the link in that e-mail is clicked, the thief would not be able to log in.

In every case I've heard, these thieves were able to access ACR's platform WITHOUT ever clicking that link. That is highly suspicious, and indicative that this wasn't simply a credential stuffing attack.

For example, even if I had the list of every single e-mail and password of every ACR player, I couldn't log in to any of them. I would get the message to check my e-mail to authorize a new device logging in, and I would be stuck at that point, being unable to access these users' e-mail. Somehow these thieves did NOT run into this problem!



Is there anything else suspicious here?

Yes. To my knowledge, not a single account was hit for more than $14,000, despite the presence of players on ACR with more than $100,000 on the site.

Furthremore, the thieves seemed to know ACR's security review procedures all too well. In the case of the player who got hit for $13,623, a withdrawal of $10,000 was done first, and then the other $3,623 just 30 minutes later.

In the first case discussed here, the thieves left $206 over, and only withdrew $8849 of the $9065 balance.

In another case, a user with just $68 in his account decided to add $267 via deposit. Within 61 minutes of the deposit, someone breached his account and withdrew the same $267 he just deposited, which was first rejected twice for unknown reasons, and then processed on the third try. The original $68 was never touched.

The third case, while for the smallest amount of money, is the most bizarre. If this were a credential stuffing attack, how would the thieves have known within 61 minutes that this guy just added money to the site? Someone clearly had insider knowledge in some way that this deposit occurred.

I also have a case where someone's withdrawal simply disappeared. This was NOT an account breach, but rather a situation where they withdrew money, and it never showed up to their bitcoin address. ACR will NOT provide this person with the address where the bitcoin was actually sent, but simply insists that it was paid out!



What are your theories as to what is going on here?

This is almost surely being perpetrated by either someone who works for ACR, or someone who works for their payment processor, DigitalExchange.

Note that in one of the cases described above, an account breach occurred just 61 minutes after the user had deposited, and the idenitcal amount of money was cashed out. Only the payment processor and ACR would have this information.

It is possible that the payment processor is given more access to ACR's platform than we are aware, and might be able to bypass security procedures normally in place for logins. It is also possible that insiders at ACR are simply forcing their way into these accounts, and making unauthorized cashouts. It is possible that ACR insiders AND insiders at DigitalExchange are in cahoots to steal this money.

It is unlikely that management is involved. As mentioned before, nobody has had more than $14k stolen, and some of the thefts are for 3-figure amounts. Furthermore, this appears to be hitting a relatively small number of people -- possibly to stay under the radar. This appears to be a crime of opportunity, and the last known instance was on April 1 -- after I had called it out and made CEO Phil Nagy aware of it, via a third-party. It simply would not be worth the reputation hit for ACR to steal this amount of money.



Where might the ACR app fit into this?

I have never used the ACR app, so I can only speculate. However, I doubt it's a coincidence that the ACR app went offline on the same day that they publicly acknolwedged this theft issue.

It is possible that the app was the means to access these accounts, and that some insider discovered this in January 2022. An insider at ACR -- perhaps someone who worked on development on the app -- may have discovered a way to manipulate the API calls (the interface between the app and ACR's server) to log into accounts without needing to click on any new device verification link. If that person also had a way to access ACR e-mail/password/screename combos, they could simply observe accounts on the system, and target select people either depositing or displaying money on the system (such as those sitting with thousands on a cash table).

It is possible that ACR's temporary "fix" for the matter was to shut off the app completely while examining the vulnerabilities, and then also requiring confirmation e-mails to be sent by the player to their processor when a cashout was requested. This is a common tactic in system security, where a temporary blockade on the vulnerability is introduced, while a more permanent security solution is researched and tested.



Why won't ACR release the IP addresses or bitcoin addresses of the thieves?

ACR has admitted that theft occurred, so why won't they release this info, even to the victims? Shouldn't everyone have a right to get the bitcoin address of where their money went?

My guess is they're afraid that the smart and crypto-expert poker community would be able to trace this information back to these ACR and/or payment processor insiders, and there would be a tremendous crisis of confidence regarding people's ACR funds. Thus, it makes far more business sense to attempt to keep this information private.



If the credential stuffing attack story isn't true, why is ACR claiming that?

A credential stuffing attack gives them the best excuse for this matter. It's not their fault if OTHER sites were hacked, and if certain users were dumb enough to use the same e-mail/password combo in multiple places, right?

While they do acknowledge a "vulnerability" they have patched, presumably they're implying that they are tightening up the requirements to verify that the person requesting the cashout is really who they say they are.

By characterizing it as an external attack by hackers who preyed upon users with identical passwords everywhere, they can make it appear as if their fault in the matter is very limited, and combined with reimbursing victims, they figured this would all go away.



If this has been happening since January 26, and they've known about it since close to that date, why is this action only occurring on April 7?

That's a great question, and I'd love to hear their answer to this.

I do think that they felt a lack of urgency because it was only happening to a relatively small number of accounts, and they possibly decided to see if they could catch the insiders red-handed. They probably figured that they could simply investigate and refund anyone who was victimized in the meantime. Perhaps they even had checks in place for large cashouts (maybe over $10,000), which would prevent any account from being hit for something huge.

It is no coincidence that they are finally taking action and making a public statement since I pressed the issue hard over the past week or so. As none of the victims were high profile or known poker pros, I can assure you that this would have stayed under the radar had I not brought attention to it.



What do you want from ACR now?

I am relatively satisfied in my belief that ACR management/ownership was NOT in on this, and that their goal was to make all victims whole.

However, several people are still waiting for their funds back, and we also aren't getting the truth regarding what happened here.

ACR just needs to come clean about what happened, and then be transparent regarding steps they took to prevent it going forward. This can be done without giving away too much information to help future hackers. They are one of the two biggest US-facing online poker sites, so they need to be honest with the community, and not just push a narrative which paints them as the least culpable. The community deserves to know the truth about what happened, and whether their money is safe on ACR going forward.

As far as the verification email to verify the new device being used - After the players realized their accounts had been drained, was the verification email still in their inbox as "new mail"? Or is there a way for the player to retroactively see if the link was clicked?

It wouldn't be to much of a stretch to assume these people also used the same password for their email account as they used for their ACR account since they used it for at least 2 other accounts, assuming a CSA Attack was used.

A side note - You would think modern technology would prevent blasting email and password combinations to a site, even if they used multiple devices. Strange.

As far as the small 3 digit withdrawal, it's possible they came across accounts that had low to no balances during their process and made a list of accounts that were active with regular activity and repeatedly logged into these accounts throughout the day knowing some will eventually get a deposit. When the account had $68 they may have figured it wasn't worth a withdrawal to expose the hack knowing it would eventually get a deposit. Once the player deposited $267, they may have realized that's as good as it would get. It could be a 3rd world country where they are paying someone $20/day to repeatedly log into a list of previously accessed accounts that had were hacked but had low to no balances - They continuously login until they get one where someone made a deposit. Just a theory.

Also, I think there could be a half truth to ACR's explanation that maybe they did have an outside party that accessed accounts with the emails and passwords, then at some point recruited a rogue employee to seam things together. They can "recruit" dishonest employees off sites such as LinkedIn, probably wouldn't take long to find someone that would work with you.

But yeah, overall there is suspicion about ACR's explanation of it being a "Credential Stuffing Attack". Seems like the easiest way to deflect blame.

People on Twitter are hilarious.


https://twitter.com/ToddWitteles/sta...60309017718788

Quote:

---

Originally Posted by PositiveVariance

As far as the verification email to verify the new device being used - After the players realized their accounts had been drained, was the verification email still in their inbox as "new mail"? Or is there a way for the player to retroactively see if the link was clicked?

It wouldn't be to much of a stretch to assume these people also used the same password for their email account as they used for their ACR account since they used it for at least 2 other accounts, assuming a CSA Attack was used.

A side note - You would think modern technology would prevent blasting email and password combinations to a site, even if they used multiple devices. Strange.

As far as the small 3 digit withdrawal, it's possible they came across accounts that had low to no balances during their process and made a list of accounts that were active with regular activity and repeatedly logged into these accounts throughout the day knowing some will eventually get a deposit. When the account had $68 they may have figured it wasn't worth a withdrawal to expose the hack knowing it would eventually get a deposit. Once the player deposited $267, they may have realized that's as good as it would get. It could be a 3rd world country where they are paying someone $20/day to repeatedly log into a list of previously accessed accounts that had were hacked but had low to no balances - They continuously login until they get one where someone made a deposit. Just a theory.

Also, I think there could be a half truth to ACR's explanation that maybe they did have an outside party that accessed accounts with the emails and passwords, then at some point recruited a rogue employee to seam things together. They can "recruit" dishonest employees off sites such as LinkedIn, probably wouldn't take long to find someone that would work with you.

But yeah, overall there is suspicion about ACR's explanation of it being a "Credential Stuffing Attack". Seems like the easiest way to deflect blame.

---

You raise some good points here, but when I think about the totality of information I have, it just doesn't make sense to be a simple credential stuffing attack by outsiders.

For one, the first guy who reported this on Twitter (the one in the original post of this thread) insists that his Hotmail does not have any logs of strange IPs logging in, and the new device verification e-mail was unopened.

Many others didn't get a new device verification e-mail at all.

If there's any credential stuffing going on, it might be that some clever insider bought a list of e-mail/password combos on the black market, auto-deleted any e-mail which didn't match ACR accounts, and then was able to read or intercept the new device verification link e-mail. That is, it's possible that the paswords on ACR really were securely stored, but the outgoing e-mail queue was not secure, so anyone with server access and a list of bought passwords could probably get into some accounts.

It's very possible that accounts were targeted after they saw some event in the system logs -- a player standing up from a cash table with thousands, winning a tournament, or depositing new funds.

It is unlikely that they were repeatedly logging into accounts to check if they had new deposits, because that wouldn't be worth their time. Most deposits are fairly small. It would be much more effective to simply target the accounts with $5000+ balances, and steal them, while not going after the huge accounts which might be under some kind of review at withdrawal.

I got another update e-mail from yet another victim -- one I haven't mentioned here yet. This guy had about $2200 in his account, but only $2000 was stolen. (Notice the leaving $200 over, just like first-described theft.) He did NOT get a new device e-mail, only the withdrawal e-mail.

He just got back his money yesterday. This was the latest known theft -- Sunday, April 3.

I had him ask for the IP and bitcoin address info regarding the withdrawal, and of course ACR ignored him.

"serenity21" from 2+2 posted the following e-mail from ACR he recently got when trying to withdraw:

Quote:

---

We hope this email finds you well.

In order to move forward with your recent cash out request, email us at cashier@digitalexchange.eu from your registered email with the following information:

- Amount of this cashout
- BTC Receiving Address for this cashout
- Date and amount of your last deposit.

As soon as we hear from you, we will move forward to process your cash out request. Otherwise, if we do not hear from you within 24 hours, your transaction will be canceled.

---

https://forumserver.twoplustwo.com/s...ostcount=35840


Interesting.

So they're definitely trying to catch people making unauthorized cashouts on others' accounts, though I'm not sure how this info is "verification". Wouldn't the thieves have all of this, except perhaps the date/amount of last deposit? But at the same time, legit players forget the date/amount of last deposit -- including me!

I have since been told that the above info request has been done as far back as 2018, and is not related to this incident. Apparently it happens "once every 7 or 8 cashouts, almost at random", according to this person.

So I'm theorizing that this request is when the system suspects anything even slightly "off", and not necessarily because of what has been happening lately.

However, it's possible they increased the usage of this, given everything that's been going on lately.

Seems like they would have every user change their password at there next login as some company's do when they have a security breach.

Also, have users set up a 4 digit pin that is requested at cashouts for verification. Upon cashout the employee would have to manually enter it in the system and it would have to match the number on file. No match- No cashout. A stranger would be guessing at a possibility of 9,999 potential combos. Have to where only upper management can see or change a pin if the account holder forgets it.

Hey guys, remember this story?

I was really gaining traction, until it was drowned out by explosive cheating allegations Ali Imsirovic and Bryn Kenney.

In any case, I believe this has mostly reached a conclusion. I recently got contacted by a guy whose account was breached on April 6 -- the latest known instance of this. However, this is still one day BEFORE they made a public statement about it, and took their mobile app offline.

The mobile app is back now, after about a 2-week hiatus. I have not received reports about any further incidents since April 6. Oddly, a low stakes player victimized for $125 on March 24 claims he was DENIED a refund! I told him to e-mail again, bring up this scandal, and let me know if they still refuse.

It does appear that they most likely closed this vulnerability on April 7, and this probably won't be happening anymore. However, ACR has not been completely truthful about the whole thing, as I've already mentioned.

One thing I have found that is constant among the victims -- they DID use the same passwords on ACR as they did on some other websites. Not a single one told me they had a unique password for ACR. This makes ACR's "credential stuffing attack" claim seem true. However, it ALSO seems that this was done by an insider -- one who likely needed the outside database of hacked passwords in order to make the rest of his plan work.

I will share below my tweets about my recent conclusions:

https://twitter.com/ToddWitteles/sta...52515459203072

https://twitter.com/ToddWitteles/sta...53957985177600

https://twitter.com/ToddWitteles/sta...55206214270977

https://twitter.com/ToddWitteles/sta...56180026777600

https://twitter.com/ToddWitteles/sta...60680061980672

I know for a fact that WPN doesn't like refunding anything bc of hacks.

My True poker account was hacked 2 years ago, the thief tried a crypto cashout but I got the email and was able to get back in and cancel it. The hacker then was so mad that he just punted my balance in blackjack and WPN refused to refund it despite the fact that it was obviously from a totally different IP that had never been on my account before (and my account had never gambled on anything thats not poker before)...