Posts: 44
Threads: 29
Joined: Jul 2026
intraverse.io — 16.9M Records From a Web3 Casino Bot Farm Exposed via Keyless Firebase RTDB
@exfilar| August 17, 2026
About the leak
intraverse.io — the production Firebase backend of Intraverse/Gamifi, a web3 gambling platform running NFT-community casino games (Cool Cats Claw Machine, 0n1 Force Coin Flip, Meme Fighter, Lazy Lions, Katana) on Soneium and ApeChain — left its entire production Realtime Database keyless. Our proprietary mass Firebase sweep (20,654 project IDs probed) caught it. No auth. No token. No referer check. Full read access to 16,898,017 database leaves (518 MB raw JSON) spanning 735,705 recorded casino wins and 16,154,575 per-user notifications. Every liveWins record ties a real player's wallet address to their bets, payouts, and username — and the noova key exposes the platform's own automated gambling-bot orchestration layer.
The database contains the complete house-bot stack: 5 bot configurations betting real ETH and APE on behalf of the casino (cool-cats-son and on1-force enabled, 0.0035 ETH per game on Soneium), 48 funded game-instance wallets, 3 manager funding wallets, a gas oracle (cashOutGas/createGameGas per chain), per-bot P&L (on1-force: 3,565 games, net PL −0.63 ETH; ape-mania: −368.6 APE over 480 games), and funding deficits — apechain alone requires 14,048 APE per day and reports out_of_funds. The noova configs leak a working DRPC API key (Ai_8OxMUqE9Cj1xO8HT6AgEz3ap5Aq4R8bNrehXRfUMv) validated against 12+ EVM chains, plus Discord alerting infrastructure (channel 1445050152950960292, operator 708219897108365332).
On-chain verification confirms the wallets are live: Soneium instance balances match the RTDB exactly (0.0193 ETH, 0.0034 ETH, 0.0014 ETH...), while ApeChain instance wallets have been drained to 0.002 APE dust — the RTDB still reports 681.55 APE across them. The ApeChain manager wallet holds 115.37 APE on-chain versus 9.27 APE in the database — a 12x desync from a dead sync job. Player wallets are live-funded too: a 300-wallet sample showed 139 addresses with over 0.001 ETH, totaling 2.45 ETH, top wallet 0x6e92... holding 0.3888 ETH.
Numbers
Date: 17.08.2026
Format: Full production RTDB export (518 MB raw) + full storage bucket (193 objects, 77.7 MB)
RTDB Leaves: 16,898,017
Casino Wins (liveWins): 735,705
Notifications: 16,154,575
Unique Wallet Addresses: 2,368 (53 bot + 2,315 player)
Bot Configs: 5 (Soneium / ApeChain / MegaETH)
Game Kinds: claw_machine | cash_or_crash | rug_pull | coin_flip
Tokens: ETH | APE | ROAR | DTC | KAT
CVSS: 9.1 (keyless RTDB) | 8.6 (player wallet exposure) | 7.5 (DRPC key)
Compromised Data Includes
liveWins · playerWalletAddress · username · betAmount · payoutAmount · multiplier · usdValue · symbol · gameKind · entryName · createdAt
notification · userId · type (IP / InitialCredit / QuestApplication) · data.amount · status · FCM device tokens
noova · rpcUrl (with API key) · manager wallets · 48 instance wallets + balances · funding deficits · gas oracle · Discord IDs · per-bot P&L
config · tickets.price · zkproof.enabled · loginMethods · allowedAdmins UIDs
Affected Entities
2,315+ casino players — wallet addresses linked to full bet history, payout amounts, usernames, and USD values
Intraverse / Gamifi web3 casino — production backend of NFT-community gambling on Soneium + ApeChain
48 bot wallets + 3 manager wallets with live on-chain balances (~115.4 APE + ~0.116 ETH)
Discord operator infrastructure (channel 1445050152950960292)
Galxe quest program (questId 95e29vOaMjBMF5WKfSGW — application approvals)
House randomness: RANDAO zkproof circuit artifacts public (circuit_final.zkey 32.6 MB)
Infrastructure Map
Production RTDB — PUBLIC, read, no auth
Domain: intraverse.io (Intraverse/Gamifi web3 casino)
Project: coc-prod
Data: 16,898,017 leaves / 518 MB
liveWins: 735,705 | notification: 16,154,575 | noova: bot orchestration
Wallets: 2,368 unique (53 bot + 2,315 player)
Bot: 5 configs, 48 instances, 3 funding managers, DRPC key in rpcUrl
Storage: keyless — 193 objects (platform-entries + zkey RANDAO circuit)
Chain IDs: Soneium 1868 (ETH), ApeChain 33139 (APE), MegaETH 4326 (ETH)
Assets CDN: good-assets.intraverse.io
Live Access Status (August 17, 2026)
database read — LIVE (no auth, anonymous HTTP GET)
database write — DENIED (PUT/POST/DELETE rejected)
storage read — LIVE (193 objects, full download verified)
storage write — DENIED
firestore — 404 (user profiles out of reach)
Sample Data — Casino Players and Bot Infrastructure (2,368 wallets total)
Win: wHGAtgEY0AFrfHCurC3g — coin_flip, 0n1 Force, bet 0.00094 ETH, payout 0.001786 ETH (x1.9),
user "ben", wallet 0x01bE946BFaC8a6ef97a2F278f6b3780b6F7A5Ba4
Wallet: 0x6e9237e93f5055b90f2f0e9f5754faebd4c5f46c — 0.3888 ETH live on Soneium
Wallet: 0xd147a4e5b365e3cc56ba22a25f18be06787fa6ec — 0.3414 ETH live
Wallet: 0x71e78c7197eee4ab2a5c940477383b89bfb7c5bd — 0.1952 ETH live
Top usernames: ollec06 (181 wins), HardCore (86), international-mite-48 (82)
Bot (noova):
cool-cats-son — 0.0035 ETH/game, 15 games/day, ENABLED
on1-force — 0.0035 ETH/game, 12 games/day, ENABLED
apechain — 28 APE/game, 50 games/day, disabled, daily need 14,048 APE
megaeth — 0.002 ETH, 20 games/day, disabled
Manager wallets:
Soneium 0xB29Ff392... (0.0006 ETH)
ApeChain 0x145D7386... (115.37 APE live vs 9.27 in RTDB)
MegaETH 0xcfFE2A2D... (0)
Gas oracle: cashOutGas 194,633 | createGameGas 281,785 (Soneium)
DRPC key: Ai_8OxMUqE9Cj1xO8HT6AgEz3ap5Aq4R8bNrehXRfUMv — validated on 12+ chains
What is in the dump
· coc-prod-default-rtdb.json — full production RTDB export (518 MB raw / 80.8 MB zip)
- liveWins (735,705): player wallets, bets, payouts, usernames, USD values
- notification (16,154,575): per-user events, FCM device tokens
- noova: gambling bot stack — DRPC key, 48 instance wallets, 3 managers, Discord, P&L
- configs: allowedAdmins (3 UIDs), tickets.price 0.25, zkproof.enabled, ai-agent
· storage (193 objects / 77.7 MB): platform-entries game assets (43 MB) + zkey (32 MB)
- circuit_final.zkey + randaoSeedDerivation.wasm — RANDAO fairness circuit artifacts
· 0 private keys · 0 mnemonics · 0 tx hashes · 0 contract paths — drain vector NOT present
Final word
This is not just a keyless database. This is the operating manual of a web3 casino's house bots — live wallet addresses, funding deficits, betting strategy, and a working RPC credential, sitting on a public URL next to 735,000 records of who bet, how much, and what they won. The 2,368 exposed wallets are real funded addresses on Soneium and ApeChain. The DRPC key burns someone else's quota on 12 chains. The RTDB balance feed is 12x out of sync with on-chain reality, which tells you the operators are not even watching their own bots.
The house bot lost money: on1-force net PL −0.63 ETH across 3,565 games, ape-mania −368 APE across 480 games, and the funding manager is out_of_funds on every chain. Publicly exposing your losing casino bot's wallets, keys, and Discord is how you lose the remaining 115 APE too.
coc-prod was one of 4 verified volume hits (≥200k records) from the sweep. More drops from the pipeline soon. Same tool. Different companies.
Pentest Services Available
If you are looking for penetration testing and have targets to attack, we provide such services on the side. We use refined techniques with short turnaround times. Prices start from $2,000 and up, depending on the target and scope.
DM me for inquiries: @exfilar
DL:
Disclosed via mass Firebase volume-assessment sweep — @exfilar | Report from 17.08.2026
Ban reason: banned in pwnforums (Permanent)
Reply
Reply
Reply
Reply
Reply
Posts: 226
Threads: 0
Joined: May 2026
cheers for the share bro
Ban reason: leecher (Permanent)
Reply
Reply
Reply
Reply
Reply
Posts: 416
Threads: 0
Joined: Nov 2025
(17-08-26, 04:20 PM)exfilar Wrote:
intraverse.io — 16.9M Records From a Web3 Casino Bot Farm Exposed via Keyless Firebase RTDB
@exfilar| August 17, 2026
About the leak
intraverse.io — the production Firebase backend of Intraverse/Gamifi, a web3 gambling platform running NFT-community casino games (Cool Cats Claw Machine, 0n1 Force Coin Flip, Meme Fighter, Lazy Lions, Katana) on Soneium and ApeChain — left its entire production Realtime Database keyless. Our proprietary mass Firebase sweep (20,654 project IDs probed) caught it. No auth. No token. No referer check. Full read access to 16,898,017 database leaves (518 MB raw JSON) spanning 735,705 recorded casino wins and 16,154,575 per-user notifications. Every liveWins record ties a real player's wallet address to their bets, payouts, and username — and the noova key exposes the platform's own automated gambling-bot orchestration layer.
The database contains the complete house-bot stack: 5 bot configurations betting real ETH and APE on behalf of the casino (cool-cats-son and on1-force enabled, 0.0035 ETH per game on Soneium), 48 funded game-instance wallets, 3 manager funding wallets, a gas oracle (cashOutGas/createGameGas per chain), per-bot P&L (on1-force: 3,565 games, net PL −0.63 ETH; ape-mania: −368.6 APE over 480 games), and funding deficits — apechain alone requires 14,048 APE per day and reports out_of_funds. The noova configs leak a working DRPC API key (Ai_8OxMUqE9Cj1xO8HT6AgEz3ap5Aq4R8bNrehXRfUMv) validated against 12+ EVM chains, plus Discord alerting infrastructure (channel 1445050152950960292, operator 708219897108365332).
On-chain verification confirms the wallets are live: Soneium instance balances match the RTDB exactly (0.0193 ETH, 0.0034 ETH, 0.0014 ETH...), while ApeChain instance wallets have been drained to 0.002 APE dust — the RTDB still reports 681.55 APE across them. The ApeChain manager wallet holds 115.37 APE on-chain versus 9.27 APE in the database — a 12x desync from a dead sync job. Player wallets are live-funded too: a 300-wallet sample showed 139 addresses with over 0.001 ETH, totaling 2.45 ETH, top wallet 0x6e92... holding 0.3888 ETH.
Numbers
Date: 17.08.2026
Format: Full production RTDB export (518 MB raw) + full storage bucket (193 objects, 77.7 MB)
RTDB Leaves: 16,898,017
Casino Wins (liveWins): 735,705
Notifications: 16,154,575
Unique Wallet Addresses: 2,368 (53 bot + 2,315 player)
Bot Configs: 5 (Soneium / ApeChain / MegaETH)
Game Kinds: claw_machine | cash_or_crash | rug_pull | coin_flip
Tokens: ETH | APE | ROAR | DTC | KAT
CVSS: 9.1 (keyless RTDB) | 8.6 (player wallet exposure) | 7.5 (DRPC key)
Compromised Data Includes
liveWins · playerWalletAddress · username · betAmount · payoutAmount · multiplier · usdValue · symbol · gameKind · entryName · createdAt
notification · userId · type (IP / InitialCredit / QuestApplication) · data.amount · status · FCM device tokens
noova · rpcUrl (with API key) · manager wallets · 48 instance wallets + balances · funding deficits · gas oracle · Discord IDs · per-bot P&L
config · tickets.price · zkproof.enabled · loginMethods · allowedAdmins UIDs
Affected Entities
2,315+ casino players — wallet addresses linked to full bet history, payout amounts, usernames, and USD values
Intraverse / Gamifi web3 casino — production backend of NFT-community gambling on Soneium + ApeChain
48 bot wallets + 3 manager wallets with live on-chain balances (~115.4 APE + ~0.116 ETH)
Discord operator infrastructure (channel 1445050152950960292)
Galxe quest program (questId 95e29vOaMjBMF5WKfSGW — application approvals)
House randomness: RANDAO zkproof circuit artifacts public (circuit_final.zkey 32.6 MB)
Infrastructure Map
Production RTDB — PUBLIC, read, no auth
Domain: intraverse.io (Intraverse/Gamifi web3 casino)
Project: coc-prod
Data: 16,898,017 leaves / 518 MB
liveWins: 735,705 | notification: 16,154,575 | noova: bot orchestration
Wallets: 2,368 unique (53 bot + 2,315 player)
Bot: 5 configs, 48 instances, 3 funding managers, DRPC key in rpcUrl
Storage: keyless — 193 objects (platform-entries + zkey RANDAO circuit)
Chain IDs: Soneium 1868 (ETH), ApeChain 33139 (APE), MegaETH 4326 (ETH)
Assets CDN: good-assets.intraverse.io
Live Access Status (August 17, 2026)
database read — LIVE (no auth, anonymous HTTP GET)
database write — DENIED (PUT/POST/DELETE rejected)
storage read — LIVE (193 objects, full download verified)
storage write — DENIED
firestore — 404 (user profiles out of reach)
Sample Data — Casino Players and Bot Infrastructure (2,368 wallets total)
Win: wHGAtgEY0AFrfHCurC3g — coin_flip, 0n1 Force, bet 0.00094 ETH, payout 0.001786 ETH (x1.9),
user "ben", wallet 0x01bE946BFaC8a6ef97a2F278f6b3780b6F7A5Ba4
Wallet: 0x6e9237e93f5055b90f2f0e9f5754faebd4c5f46c — 0.3888 ETH live on Soneium
Wallet: 0xd147a4e5b365e3cc56ba22a25f18be06787fa6ec — 0.3414 ETH live
Wallet: 0x71e78c7197eee4ab2a5c940477383b89bfb7c5bd — 0.1952 ETH live
Top usernames: ollec06 (181 wins), HardCore (86), international-mite-48 (82)
Bot (noova):
cool-cats-son — 0.0035 ETH/game, 15 games/day, ENABLED
on1-force — 0.0035 ETH/game, 12 games/day, ENABLED
apechain — 28 APE/game, 50 games/day, disabled, daily need 14,048 APE
megaeth — 0.002 ETH, 20 games/day, disabled
Manager wallets:
Soneium 0xB29Ff392... (0.0006 ETH)
ApeChain 0x145D7386... (115.37 APE live vs 9.27 in RTDB)
MegaETH 0xcfFE2A2D... (0)
Gas oracle: cashOutGas 194,633 | createGameGas 281,785 (Soneium)
DRPC key: Ai_8OxMUqE9Cj1xO8HT6AgEz3ap5Aq4R8bNrehXRfUMv — validated on 12+ chains
What is in the dump
· coc-prod-default-rtdb.json — full production RTDB export (518 MB raw / 80.8 MB zip)
- liveWins (735,705): player wallets, bets, payouts, usernames, USD values
- notification (16,154,575): per-user events, FCM device tokens
- noova: gambling bot stack — DRPC key, 48 instance wallets, 3 managers, Discord, P&L
- configs: allowedAdmins (3 UIDs), tickets.price 0.25, zkproof.enabled, ai-agent
· storage (193 objects / 77.7 MB): platform-entries game assets (43 MB) + zkey (32 MB)
- circuit_final.zkey + randaoSeedDerivation.wasm — RANDAO fairness circuit artifacts
· 0 private keys · 0 mnemonics · 0 tx hashes · 0 contract paths — drain vector NOT present
Final word
This is not just a keyless database. This is the operating manual of a web3 casino's house bots — live wallet addresses, funding deficits, betting strategy, and a working RPC credential, sitting on a public URL next to 735,000 records of who bet, how much, and what they won. The 2,368 exposed wallets are real funded addresses on Soneium and ApeChain. The DRPC key burns someone else's quota on 12 chains. The RTDB balance feed is 12x out of sync with on-chain reality, which tells you the operators are not even watching their own bots.
The house bot lost money: on1-force net PL −0.63 ETH across 3,565 games, ape-mania −368 APE across 480 games, and the funding manager is out_of_funds on every chain. Publicly exposing your losing casino bot's wallets, keys, and Discord is how you lose the remaining 115 APE too.
coc-prod was one of 4 verified volume hits (≥200k records) from the sweep. More drops from the pipeline soon. Same tool. Different companies.
Pentest Services Available
If you are looking for penetration testing and have targets to attack, we provide such services on the side. We use refined techniques with short turnaround times. Prices start from $2,000 and up, depending on the target and scope.
DM me for inquiries: @exfilar
DL:
Disclosed via mass Firebase volume-assessment sweep — @exfilar | Report from 17.08.2026
fuck its just a sample !
Ban reason: leecher (Permanent)
Reply
Reply
Reply
Reply
Reply
Posts: 110
Threads: 0
Joined: Jul 2026
wow oho ho
Reply
Reply
Reply
Reply
Reply
Posts: 18
Threads: 0
Joined: Aug 2026
(17-08-26, 04:20 PM)exfilar Wrote:
intraverse.io — 16.9M Records From a Web3 Casino Bot Farm Exposed via Keyless Firebase RTDB
@exfilar| August 17, 2026
About the leak
intraverse.io — the production Firebase backend of Intraverse/Gamifi, a web3 gambling platform running NFT-community casino games (Cool Cats Claw Machine, 0n1 Force Coin Flip, Meme Fighter, Lazy Lions, Katana) on Soneium and ApeChain — left its entire production Realtime Database keyless. Our proprietary mass Firebase sweep (20,654 project IDs probed) caught it. No auth. No token. No referer check. Full read access to 16,898,017 database leaves (518 MB raw JSON) spanning 735,705 recorded casino wins and 16,154,575 per-user notifications. Every liveWins record ties a real player's wallet address to their bets, payouts, and username — and the noova key exposes the platform's own automated gambling-bot orchestration layer.
The database contains the complete house-bot stack: 5 bot configurations betting real ETH and APE on behalf of the casino (cool-cats-son and on1-force enabled, 0.0035 ETH per game on Soneium), 48 funded game-instance wallets, 3 manager funding wallets, a gas oracle (cashOutGas/createGameGas per chain), per-bot P&L (on1-force: 3,565 games, net PL −0.63 ETH; ape-mania: −368.6 APE over 480 games), and funding deficits — apechain alone requires 14,048 APE per day and reports out_of_funds. The noova configs leak a working DRPC API key (Ai_8OxMUqE9Cj1xO8HT6AgEz3ap5Aq4R8bNrehXRfUMv) validated against 12+ EVM chains, plus Discord alerting infrastructure (channel 1445050152950960292, operator 708219897108365332).
On-chain verification confirms the wallets are live: Soneium instance balances match the RTDB exactly (0.0193 ETH, 0.0034 ETH, 0.0014 ETH...), while ApeChain instance wallets have been drained to 0.002 APE dust — the RTDB still reports 681.55 APE across them. The ApeChain manager wallet holds 115.37 APE on-chain versus 9.27 APE in the database — a 12x desync from a dead sync job. Player wallets are live-funded too: a 300-wallet sample showed 139 addresses with over 0.001 ETH, totaling 2.45 ETH, top wallet 0x6e92... holding 0.3888 ETH.
Numbers
Date: 17.08.2026
Format: Full production RTDB export (518 MB raw) + full storage bucket (193 objects, 77.7 MB)
RTDB Leaves: 16,898,017
Casino Wins (liveWins): 735,705
Notifications: 16,154,575
Unique Wallet Addresses: 2,368 (53 bot + 2,315 player)
Bot Configs: 5 (Soneium / ApeChain / MegaETH)
Game Kinds: claw_machine | cash_or_crash | rug_pull | coin_flip
Tokens: ETH | APE | ROAR | DTC | KAT
CVSS: 9.1 (keyless RTDB) | 8.6 (player wallet exposure) | 7.5 (DRPC key)
Compromised Data Includes
liveWins · playerWalletAddress · username · betAmount · payoutAmount · multiplier · usdValue · symbol · gameKind · entryName · createdAt
notification · userId · type (IP / InitialCredit / QuestApplication) · data.amount · status · FCM device tokens
noova · rpcUrl (with API key) · manager wallets · 48 instance wallets + balances · funding deficits · gas oracle · Discord IDs · per-bot P&L
config · tickets.price · zkproof.enabled · loginMethods · allowedAdmins UIDs
Affected Entities
2,315+ casino players — wallet addresses linked to full bet history, payout amounts, usernames, and USD values
Intraverse / Gamifi web3 casino — production backend of NFT-community gambling on Soneium + ApeChain
48 bot wallets + 3 manager wallets with live on-chain balances (~115.4 APE + ~0.116 ETH)
Discord operator infrastructure (channel 1445050152950960292)
Galxe quest program (questId 95e29vOaMjBMF5WKfSGW — application approvals)
House randomness: RANDAO zkproof circuit artifacts public (circuit_final.zkey 32.6 MB)
Infrastructure Map
Production RTDB — PUBLIC, read, no auth
Domain: intraverse.io (Intraverse/Gamifi web3 casino)
Project: coc-prod
Data: 16,898,017 leaves / 518 MB
liveWins: 735,705 | notification: 16,154,575 | noova: bot orchestration
Wallets: 2,368 unique (53 bot + 2,315 player)
Bot: 5 configs, 48 instances, 3 funding managers, DRPC key in rpcUrl
Storage: keyless — 193 objects (platform-entries + zkey RANDAO circuit)
Chain IDs: Soneium 1868 (ETH), ApeChain 33139 (APE), MegaETH 4326 (ETH)
Assets CDN: good-assets.intraverse.io
Live Access Status (August 17, 2026)
database read — LIVE (no auth, anonymous HTTP GET)
database write — DENIED (PUT/POST/DELETE rejected)
storage read — LIVE (193 objects, full download verified)
storage write — DENIED
firestore — 404 (user profiles out of reach)
Sample Data — Casino Players and Bot Infrastructure (2,368 wallets total)
Win: wHGAtgEY0AFrfHCurC3g — coin_flip, 0n1 Force, bet 0.00094 ETH, payout 0.001786 ETH (x1.9),
user "ben", wallet 0x01bE946BFaC8a6ef97a2F278f6b3780b6F7A5Ba4
Wallet: 0x6e9237e93f5055b90f2f0e9f5754faebd4c5f46c — 0.3888 ETH live on Soneium
Wallet: 0xd147a4e5b365e3cc56ba22a25f18be06787fa6ec — 0.3414 ETH live
Wallet: 0x71e78c7197eee4ab2a5c940477383b89bfb7c5bd — 0.1952 ETH live
Top usernames: ollec06 (181 wins), HardCore (86), international-mite-48 (82)
Bot (noova):
cool-cats-son — 0.0035 ETH/game, 15 games/day, ENABLED
on1-force — 0.0035 ETH/game, 12 games/day, ENABLED
apechain — 28 APE/game, 50 games/day, disabled, daily need 14,048 APE
megaeth — 0.002 ETH, 20 games/day, disabled
Manager wallets:
Soneium 0xB29Ff392... (0.0006 ETH)
ApeChain 0x145D7386... (115.37 APE live vs 9.27 in RTDB)
MegaETH 0xcfFE2A2D... (0)
Gas oracle: cashOutGas 194,633 | createGameGas 281,785 (Soneium)
DRPC key: Ai_8OxMUqE9Cj1xO8HT6AgEz3ap5Aq4R8bNrehXRfUMv — validated on 12+ chains
What is in the dump
· coc-prod-default-rtdb.json — full production RTDB export (518 MB raw / 80.8 MB zip)
- liveWins (735,705): player wallets, bets, payouts, usernames, USD values
- notification (16,154,575): per-user events, FCM device tokens
- noova: gambling bot stack — DRPC key, 48 instance wallets, 3 managers, Discord, P&L
- configs: allowedAdmins (3 UIDs), tickets.price 0.25, zkproof.enabled, ai-agent
· storage (193 objects / 77.7 MB): platform-entries game assets (43 MB) + zkey (32 MB)
- circuit_final.zkey + randaoSeedDerivation.wasm — RANDAO fairness circuit artifacts
· 0 private keys · 0 mnemonics · 0 tx hashes · 0 contract paths — drain vector NOT present
Final word
This is not just a keyless database. This is the operating manual of a web3 casino's house bots — live wallet addresses, funding deficits, betting strategy, and a working RPC credential, sitting on a public URL next to 735,000 records of who bet, how much, and what they won. The 2,368 exposed wallets are real funded addresses on Soneium and ApeChain. The DRPC key burns someone else's quota on 12 chains. The RTDB balance feed is 12x out of sync with on-chain reality, which tells you the operators are not even watching their own bots.
The house bot lost money: on1-force net PL −0.63 ETH across 3,565 games, ape-mania −368 APE across 480 games, and the funding manager is out_of_funds on every chain. Publicly exposing your losing casino bot's wallets, keys, and Discord is how you lose the remaining 115 APE too.
coc-prod was one of 4 verified volume hits (≥200k records) from the sweep. More drops from the pipeline soon. Same tool. Different companies.
Pentest Services Available
If you are looking for penetration testing and have targets to attack, we provide such services on the side. We use refined techniques with short turnaround times. Prices start from $2,000 and up, depending on the target and scope.
DM me for inquiries: @exfilar
DL:
Disclosed via mass Firebase volume-assessment sweep — @exfilar | Report from 17.08.2026
Reply
Reply
Reply
Reply
Reply
Posts: 86
Threads: 0
Joined: Sep 2025
thanks
Reply
Reply
Reply
Reply
Reply
Posts: 51
Threads: 0
Joined: Mar 2026
Tks for the share
Reply
Reply
Reply
Reply
Reply
Posts: 196
Threads: 0
Joined: Dec 2025
Thanks for share!
Reply
Reply
Reply
Reply
Reply
Posts: 144
Threads: 0
Joined: Jan 2026
Thank you for sharing
Reply
Reply
Reply
Reply
Reply
Posts: 115
Threads: 0
Joined: Oct 2025
(17-08-26, 04:20 PM)exfilar Wrote:
intraverse.io — 16.9M Records From a Web3 Casino Bot Farm Exposed via Keyless Firebase RTDB
@exfilar| August 17, 2026
About the leak
intraverse.io — the production Firebase backend of Intraverse/Gamifi, a web3 gambling platform running NFT-community casino games (Cool Cats Claw Machine, 0n1 Force Coin Flip, Meme Fighter, Lazy Lions, Katana) on Soneium and ApeChain — left its entire production Realtime Database keyless. Our proprietary mass Firebase sweep (20,654 project IDs probed) caught it. No auth. No token. No referer check. Full read access to 16,898,017 database leaves (518 MB raw JSON) spanning 735,705 recorded casino wins and 16,154,575 per-user notifications. Every liveWins record ties a real player's wallet address to their bets, payouts, and username — and the noova key exposes the platform's own automated gambling-bot orchestration layer.
The database contains the complete house-bot stack: 5 bot configurations betting real ETH and APE on behalf of the casino (cool-cats-son and on1-force enabled, 0.0035 ETH per game on Soneium), 48 funded game-instance wallets, 3 manager funding wallets, a gas oracle (cashOutGas/createGameGas per chain), per-bot P&L (on1-force: 3,565 games, net PL −0.63 ETH; ape-mania: −368.6 APE over 480 games), and funding deficits — apechain alone requires 14,048 APE per day and reports out_of_funds. The noova configs leak a working DRPC API key (Ai_8OxMUqE9Cj1xO8HT6AgEz3ap5Aq4R8bNrehXRfUMv) validated against 12+ EVM chains, plus Discord alerting infrastructure (channel 1445050152950960292, operator 708219897108365332).
On-chain verification confirms the wallets are live: Soneium instance balances match the RTDB exactly (0.0193 ETH, 0.0034 ETH, 0.0014 ETH...), while ApeChain instance wallets have been drained to 0.002 APE dust — the RTDB still reports 681.55 APE across them. The ApeChain manager wallet holds 115.37 APE on-chain versus 9.27 APE in the database — a 12x desync from a dead sync job. Player wallets are live-funded too: a 300-wallet sample showed 139 addresses with over 0.001 ETH, totaling 2.45 ETH, top wallet 0x6e92... holding 0.3888 ETH.
Numbers
Date: 17.08.2026
Format: Full production RTDB export (518 MB raw) + full storage bucket (193 objects, 77.7 MB)
RTDB Leaves: 16,898,017
Casino Wins (liveWins): 735,705
Notifications: 16,154,575
Unique Wallet Addresses: 2,368 (53 bot + 2,315 player)
Bot Configs: 5 (Soneium / ApeChain / MegaETH)
Game Kinds: claw_machine | cash_or_crash | rug_pull | coin_flip
Tokens: ETH | APE | ROAR | DTC | KAT
CVSS: 9.1 (keyless RTDB) | 8.6 (player wallet exposure) | 7.5 (DRPC key)
Compromised Data Includes
liveWins · playerWalletAddress · username · betAmount · payoutAmount · multiplier · usdValue · symbol · gameKind · entryName · createdAt
notification · userId · type (IP / InitialCredit / QuestApplication) · data.amount · status · FCM device tokens
noova · rpcUrl (with API key) · manager wallets · 48 instance wallets + balances · funding deficits · gas oracle · Discord IDs · per-bot P&L
config · tickets.price · zkproof.enabled · loginMethods · allowedAdmins UIDs
Affected Entities
2,315+ casino players — wallet addresses linked to full bet history, payout amounts, usernames, and USD values
Intraverse / Gamifi web3 casino — production backend of NFT-community gambling on Soneium + ApeChain
48 bot wallets + 3 manager wallets with live on-chain balances (~115.4 APE + ~0.116 ETH)
Discord operator infrastructure (channel 1445050152950960292)
Galxe quest program (questId 95e29vOaMjBMF5WKfSGW — application approvals)
House randomness: RANDAO zkproof circuit artifacts public (circuit_final.zkey 32.6 MB)
Infrastructure Map
Production RTDB — PUBLIC, read, no auth
Domain: intraverse.io (Intraverse/Gamifi web3 casino)
Project: coc-prod
Data: 16,898,017 leaves / 518 MB
liveWins: 735,705 | notification: 16,154,575 | noova: bot orchestration
Wallets: 2,368 unique (53 bot + 2,315 player)
Bot: 5 configs, 48 instances, 3 funding managers, DRPC key in rpcUrl
Storage: keyless — 193 objects (platform-entries + zkey RANDAO circuit)
Chain IDs: Soneium 1868 (ETH), ApeChain 33139 (APE), MegaETH 4326 (ETH)
Assets CDN: good-assets.intraverse.io
Live Access Status (August 17, 2026)
database read — LIVE (no auth, anonymous HTTP GET)
database write — DENIED (PUT/POST/DELETE rejected)
storage read — LIVE (193 objects, full download verified)
storage write — DENIED
firestore — 404 (user profiles out of reach)
Sample Data — Casino Players and Bot Infrastructure (2,368 wallets total)
Win: wHGAtgEY0AFrfHCurC3g — coin_flip, 0n1 Force, bet 0.00094 ETH, payout 0.001786 ETH (x1.9),
user "ben", wallet 0x01bE946BFaC8a6ef97a2F278f6b3780b6F7A5Ba4
Wallet: 0x6e9237e93f5055b90f2f0e9f5754faebd4c5f46c — 0.3888 ETH live on Soneium
Wallet: 0xd147a4e5b365e3cc56ba22a25f18be06787fa6ec — 0.3414 ETH live
Wallet: 0x71e78c7197eee4ab2a5c940477383b89bfb7c5bd — 0.1952 ETH live
Top usernames: ollec06 (181 wins), HardCore (86), international-mite-48 (82)
Bot (noova):
cool-cats-son — 0.0035 ETH/game, 15 games/day, ENABLED
on1-force — 0.0035 ETH/game, 12 games/day, ENABLED
apechain — 28 APE/game, 50 games/day, disabled, daily need 14,048 APE
megaeth — 0.002 ETH, 20 games/day, disabled
Manager wallets:
Soneium 0xB29Ff392... (0.0006 ETH)
ApeChain 0x145D7386... (115.37 APE live vs 9.27 in RTDB)
MegaETH 0xcfFE2A2D... (0)
Gas oracle: cashOutGas 194,633 | createGameGas 281,785 (Soneium)
DRPC key: Ai_8OxMUqE9Cj1xO8HT6AgEz3ap5Aq4R8bNrehXRfUMv — validated on 12+ chains
What is in the dump
· coc-prod-default-rtdb.json — full production RTDB export (518 MB raw / 80.8 MB zip)
- liveWins (735,705): player wallets, bets, payouts, usernames, USD values
- notification (16,154,575): per-user events, FCM device tokens
- noova: gambling bot stack — DRPC key, 48 instance wallets, 3 managers, Discord, P&L
- configs: allowedAdmins (3 UIDs), tickets.price 0.25, zkproof.enabled, ai-agent
· storage (193 objects / 77.7 MB): platform-entries game assets (43 MB) + zkey (32 MB)
- circuit_final.zkey + randaoSeedDerivation.wasm — RANDAO fairness circuit artifacts
· 0 private keys · 0 mnemonics · 0 tx hashes · 0 contract paths — drain vector NOT present
Final word
This is not just a keyless database. This is the operating manual of a web3 casino's house bots — live wallet addresses, funding deficits, betting strategy, and a working RPC credential, sitting on a public URL next to 735,000 records of who bet, how much, and what they won. The 2,368 exposed wallets are real funded addresses on Soneium and ApeChain. The DRPC key burns someone else's quota on 12 chains. The RTDB balance feed is 12x out of sync with on-chain reality, which tells you the operators are not even watching their own bots.
The house bot lost money: on1-force net PL −0.63 ETH across 3,565 games, ape-mania −368 APE across 480 games, and the funding manager is out_of_funds on every chain. Publicly exposing your losing casino bot's wallets, keys, and Discord is how you lose the remaining 115 APE too.
coc-prod was one of 4 verified volume hits (≥200k records) from the sweep. More drops from the pipeline soon. Same tool. Different companies.
Pentest Services Available
If you are looking for penetration testing and have targets to attack, we provide such services on the side. We use refined techniques with short turnaround times. Prices start from $2,000 and up, depending on the target and scope.
DM me for inquiries: @exfilar
DL:
Disclosed via mass Firebase volume-assessment sweep — @exfilar | Report from 17.08.2026
thank you, bro
Reply
Reply
Reply
Reply
Reply
|
