[Dooms]

thanks for shairng this

[datasellerx]

thank for share

[tito3lmashy]

replying to show the link! good share

[Hoover]

looks nice

[sulayeeh]

thank you

[halohalomr]

intraverse.io — 通过无密钥 Firebase RTDB 泄露的来自 Web3 赌场机器人农场的 1690 万条记录

@exfilar | 2026 年 8 月 17 日

---

关于此次泄露事件

：intraverse.io——Intraverse/Gamifi（一个运行在 Soneium 和 ApeChain 上的 NFT 社区赌场游戏（Cool Cats Claw Machine、0n1 Force Coin Flip、Meme Fighter、Lazy Lions、Katana）的 web3 赌博平台）的生产级 Firebase 后端——其整个生产级实时数据库未启用密钥。我们专有的 Firebase 大规模扫描（探测了 20,654 个项目 ID）发现了这一问题。没有身份验证，没有令牌，也没有引用来源检查。泄露者可以完全读取16,898,017 个数据库条目（518 MB 原始 JSON），这些条目涵盖了735,705 次赌场赢利记录和16,154,575条用户通知。每条 liveWins 记录都将真实玩家的钱包地址与其投注、赔付和用户名关联起来——而 noova 密钥则暴露了平台自身的自动化赌博机器人编排层。

数据库包含完整的赌场机器人堆栈：5 个机器人配置代表赌场下注真实的 ETH 和 APE（启用 cool-cats-son 和 on1-force，在 Soneium 上每局 0.0035 ETH），48 个已注资的游戏实例钱包，3 个管理员注资钱包，一个 gas 预言机（每条链的 cashOutGas/createGameGas），每个机器人的损益（on1-force：3,565 局游戏，净损益-0.63 ETH；ape-mania： 480 局游戏-368.6 APE），以及资金缺口——仅 apechain 每天就需要 14,048 APE，并报告out_of_funds。 noova 配置泄露了一个可用的 DRPC API 密钥（Ai_8OxMUqE9Cj1xO8HT6AgEz3ap5Aq4R8bNrehXRfUMv），该密钥已通过 12 条以上的 EVM 链验证，并包含 Discord 告警基础设施（频道 1445050152950960292，操作员 708219897108365332）。

链上验证确认钱包处于活动状态：Soneium 实例的余额与 RTDB 完全一致（0.0193 ETH、0.0034 ETH、0.0014 ETH……），而 ApeChain 实例钱包的余额已被清空至 0.002 APE——RTDB 仍然显示其总余额为 681.55 APE。 ApeChain 管理员钱包链上持有 115.37 个 APE，而数据库中仅持有 9.27 个 APE——由于同步任务失败，两者相差 12 倍。玩家钱包也都有实时充值：对 300 个钱包的抽样调查显示，有 139 个地址持有超过 0.001 个 ETH，总计 2.45 个 ETH，其中持有量最高的钱包0x6e92...持有 0.3888 个 ETH。

---

数字

Date:                    17.08.2026 Format:                  Full production RTDB export (518 MB raw) + full storage bucket (193 objects, 77.7 MB) RTDB Leaves:            16,898,017 Casino Wins (liveWins):  735,705 Notifications:          16,154,575 Unique Wallet Addresses: 2,368 (53 bot + 2,315 player) Bot Configs:            5 (Soneium / ApeChain / MegaETH) Game Kinds:              claw_machine | cash_or_crash | rug_pull | coin_flip Tokens:                  ETH | APE | ROAR | DTC | KAT CVSS:                    9.1 (keyless RTDB) | 8.6 (player wallet exposure) | 7.5 (DRPC key)

---

Compromised Data Includes

liveWins · playerWalletAddress · username · betAmount · payoutAmount · multiplier · usdValue · symbol · gameKind · entryName · createdAt
notification · userId · type (IP / InitialCredit / QuestApplication) · data.amount · status · FCM device tokens
noova · rpcUrl (with API key) · manager wallets · 48 instance wallets + balances · funding deficits · gas oracle · Discord IDs · per-bot P&L
config · tickets.price · zkproof.enabled · loginMethods · allowedAdmins UIDs

---

Affected Entities

2,315+ casino players — wallet addresses linked to full bet history, payout amounts, usernames, and USD values
Intraverse / Gamifi web3 casino — production backend of NFT-community gambling on Soneium + ApeChain
48 bot wallets + 3 manager wallets with live on-chain balances (~115.4 APE + ~0.116 ETH)
Discord operator infrastructure (channel 1445050152950960292)
Galxe quest program (questId 95e29vOaMjBMF5WKfSGW — application approvals)
House randomness: RANDAO zkproof circuit artifacts public (circuit_final.zkey 32.6 MB)

---

Infrastructure Map

Production RTDB — PUBLIC, read, no auth Domain: intraverse.io (Intraverse/Gamifi web3 casino) Project: coc-prod Data: 16,898,017 leaves / 518 MB liveWins: 735,705 | notification: 16,154,575 | noova: bot orchestration Wallets: 2,368 unique (53 bot + 2,315 player) Bot: 5 configs, 48 instances, 3 funding managers, DRPC key in rpcUrl Storage: keyless — 193 objects (platform-entries + zkey RANDAO circuit) Chain IDs: Soneium 1868 (ETH), ApeChain 33139 (APE), MegaETH 4326 (ETH) Assets CDN: good-assets.intraverse.io

---

Live Access Status (August 17, 2026)

database read — LIVE (no auth, anonymous HTTP GET) database write — DENIED (PUT/POST/DELETE rejected) storage read — LIVE (193 objects, full download verified) storage write — DENIED firestore — 404 (user profiles out of reach)

---

Sample Data — Casino Players and Bot Infrastructure (2,368 wallets total)

Win: wHGAtgEY0AFrfHCurC3g — coin_flip, 0n1 Force, bet 0.00094 ETH, payout 0.001786 ETH (x1.9),     user "ben", wallet 0x01bE946BFaC8a6ef97a2F278f6b3780b6F7A5Ba4 Wallet: 0x6e9237e93f5055b90f2f0e9f5754faebd4c5f46c — 0.3888 ETH live on Soneium Wallet: 0xd147a4e5b365e3cc56ba22a25f18be06787fa6ec — 0.3414 ETH live Wallet: 0x71e78c7197eee4ab2a5c940477383b89bfb7c5bd — 0.1952 ETH live Top usernames: ollec06 (181 wins), HardCore (86), international-mite-48 (82)

Bot (noova):   cool-cats-son — 0.0035 ETH/game, 15 games/day, ENABLED   on1-force    — 0.0035 ETH/game, 12 games/day, ENABLED   apechain    — 28 APE/game, 50 games/day, disabled, daily need 14,048 APE   megaeth      — 0.002 ETH, 20 games/day, disabled Manager wallets:   Soneium 0xB29Ff392... (0.0006 ETH)   ApeChain 0x145D7386... (115.37 APE live vs 9.27 in RTDB)   MegaETH 0xcfFE2A2D... (0) Gas oracle: cashOutGas 194,633 | createGameGas 281,785 (Soneium) DRPC key: Ai_8OxMUqE9Cj1xO8HT6AgEz3ap5Aq4R8bNrehXRfUMv — validated on 12+ chains

---

What is in the dump

· coc-prod-default-rtdb.json — full production RTDB export (518 MB raw / 80.8 MB zip)   - liveWins (735,705): player wallets, bets, payouts, usernames, USD values   - notification (16,154,575): per-user events, FCM device tokens   - noova: gambling bot stack — DRPC key, 48 instance wallets, 3 managers, Discord, P&L   - configs: allowedAdmins (3 UIDs), tickets.price 0.25, zkproof.enabled, ai-agent · storage (193 objects / 77.7 MB): platform-entries game assets (43 MB) + zkey (32 MB)   - circuit_final.zkey + randaoSeedDerivation.wasm — RANDAO fairness circuit artifacts · 0 private keys · 0 mnemonics · 0 tx hashes · 0 contract paths — drain vector NOT present

---

Final word

This is not just a keyless database. This is the operating manual of a web3 casino's house bots — live wallet addresses, funding deficits, betting strategy, and a working RPC credential, sitting on a public URL next to 735,000 records of who bet, how much, and what they won. The 2,368 exposed wallets are real funded addresses on Soneium and ApeChain. The DRPC key burns someone else's quota on 12 chains. The RTDB balance feed is 12x out of sync with on-chain reality, which tells you the operators are not even watching their own bots.

The house bot lost money: on1-force net PL −0.63 ETH across 3,565 games, ape-mania −368 APE across 480 games, and the funding manager is out_of_funds on every chain. Publicly exposing your losing casino bot's wallets, keys, and Discord is how you lose the remaining 115 APE too.

coc-prod was one of 4 verified volume hits (≥200k records) from the sweep. More drops from the pipeline soon. Same tool. Different companies.

---

Pentest Services Available

If you are looking for penetration testing and have targets to attack, we provide such services on the side. We use refined techniques with short turnaround times. Prices start from $2,000 and up, depending on the target and scope.

DM me for inquiries: @exfilar

---

DL:

---

Disclosed via mass Firebase volume-assessment sweep — @exfilar | Report from 17.08.2026

[Timaker]

thanks

[csSfl3uY3f]

thanks bro

[koronelos]

thanks mate

[EyeInferno]

Thx for share broo