EOSBet Gambling application hacked, crooks stole $200,000 worth of EOS
18.9.2018 securityaffairs Hacking

The gambling application EOSBet was affected by a vulnerability in its smart contract system that has been exploited by attackers to steal $200,000 worth of EOS.
The security breach was first reported by the member “thbourlove” of the EOSBet Reddit community that shared the code used to exploit the flaw.

After seeing the exploit code, the EOSBet’s official Reddit account admitted the hack.

“Yep, we were hacked. But we also have this exact assertion that you do. I would be careful, it’s a bit deeper than you think.” stated the EOSBet’s official Reddit account

“A million-dollar EOS gambling dApp suffered a major blow, just days after declaring itself to be the safest of its kind.” reported The Next Web website.

“Hackers have taken 40,000 EOS ($200,000) from the operating wallet of EOSBet by exploiting vulnerabilities in its smart contracts”

The gambling application is based on the EOS blockchain, it was taken offline in response to the security breach.

“[…] A few hours ago, we were attacked, and about 40,000 EOS was taken from our bankroll,” said an EOSBet spokesperson.

“This bug was not minor as was stated previously, and we are still doing forensics and piecing together what happened.”

According to the company the attackers exploited a bug in one of their games, but it seems that the same issue could affect other games of the gambling platform.

The hackers were able to forge fake hash to hijack the EOSBet’s transfer funds.

The attackers have attempted to transfer funds to a wallet under their control that looks very similar to the one used by EOSBet.

The hackers only make a limited number of transactions from a number of accounts, they used the following message or similar as a description:

“Memo: Please refund the illegal income eos, otherwise we will hire a team of lawyers in China to pursue all criminal liability and losses to you. Eosbet official eos account: eosbetdicell.”

Then crooks distributed the gains splitting them across many wallets that received small amounts of EOS tokens with the following message:

“Memo: Dear players: In order to make up for the loss of eosbet players in the hacking incident, the platform launched a recharge to send BET. 1EOS=1BET, the official eos account: eosbetdicell, the transfer will automatically give the same BET.”

It is still unclear if this incident is connected to a suspect gambler win realized the last week, the player claimed over $600,000 from EOSBet by doubling their money repeatedly in 36 hours.

Platform managers excluded any link between the hack and what is considered a legitimate win.