全 5 件のコメント

[–]greatwolf 2ポイント3ポイント  (1子コメント)

why is the casino even accepting 0-conf transactions?

[–]todu 0ポイント1ポイント  (0子コメント)

They are probably not accepting them. The "hacker" never showed that they successfully withdrew their stolen funds and only played roulette which is a single player game. Withdraw or it didn't happen.

[–]todu 1ポイント2ポイント  (0子コメント)

First of all they only tried with bitcoin worth 1 USD. That amount is so low that the casino probably doesn't care. Why didn't they try with 10 or 100 USD worth of bitcoin? That's an amount that the casino would probably check more thoroughly before accepting.

Secondly the hacker never withdrew their winnings in the video. You have not succeeded to steal money unless the money is in your hand. The hacker left the stolen amount of bitcoin on the casino site. The casino could've (and probably would've) easily just denied a withdrawal once the hacker double spent the transaction and then tried to withdraw the winnings. The hacker didn't try to win in a poker game which would involve other users. He chose to spin a wheel which is a single user game so a transaction reversal would be invisible to other users of the site. The casino probably have more lenient rules for single user games.

Even the blockchain.info site clearly displayed a warning that the transaction has been double spent and that it should not be trusted. If even they can detect it then so can anyone else. Just deny withdrawal of winnings and deny participation in multi-user casino games until a few deposit confirmations have happened on the blockchain and you won't have a problem and the user experience will not be slow from deposit to play.

The video shows "the proof" but it clearly shows the double spent transaction as "unconfirmed" during the entire video. If you're going to demonstrate a successful double spend then show an attempt that has at least one confirmation. This demonstration never shows that the double spend attempt ever confirmed.

Let's say you succeeded with double spending one Bitcoin transaction (you did not show this in the video). Then show that it was not a one time fluke and do the exact same thing once again in real time immediately after the first attempt succeeded. This hacker has shown none of this.

Another very important fact is that this double spend had a very low fee for the first transaction. It had only 0.00001 * 610 = 0.0061 USD. That's less than one cent in fee so any merchant can know that such a transaction is very unlikely to ever be confirmed by any miner (Thanks to the 1 MB blocks being constantly full causing fee requirements to be ridiculously high.). The merchant can just ignore any deposits made with a very low miner fee unless that transaction has had a few confirmations on the blockchain.

Here's the original video without the annoying and unnecessary bar on top of the video:

https://www.youtube.com/watch?v=RtGzV_-agcI

Neither video included links to the actual transactions that they were showing so here are the links so you won't have to type in the long address and transaction id manually:

http://blockr.io/address/info/1PaYfaEKAdVQ1y4Y47UoDDz65tUTR9N6ij

http://blockr.io/tx/info/cd9058fa012694ac59ebb738a11c7eea38b2045cdd366486aa638be55785f572

This video feels more like an advertisement for a competing cryptocurrency (Dash) and advertisement for the hacker group that sells their services. Also, don't try their double spending tool with amounts of bitcoin that you're not comfortable losing because if you use it without first having read and understood the source code, the authors of the double spending tool could simply wait until enough people start using it, and then start redirecting the double spend attempts to themselves instead.

tldr / tldw:

Nothing to see here that is not already known and 0-confirmation transactions are just as reliable as they have always been. The hacker tried to double spend an online casino only one time and with only 1 USD worth of bitcoin and declared "success" but never showed that the hacker managed to also withdraw the stolen funds to an address outside the casino. You simply have not succeeded to steal something if you left your loot with the original owner. The first transaction used a very low miner fee (0.0061 USD) so any merchant should expect it to never confirm and adjust their risk assessment accordingly. Silly video that exaggerates 0-confirmation risk so much that their conclusion is simply not true.

[–]nthterm 0ポイント1ポイント  (0子コメント)

please no more amanda b johnson. She's everywhere