Case Study: How 365.bet Lost $2.3M in 72 Hours — A Forensic Breakdown

On March 14， 2024， a mid-tier online casino operating under the 365.bet domain processed a withdrawal request that should have taken 20 minutes. Instead， it triggered a cascading failure that drained $2.3 million from the platform's hot wallet in under three days. The attack wasn't sophisticated. It was patient.I spent two weeks interviewing three former 365.bet engineers and one external auditor who reviewed the post-mortem. What emerged wasn't a story about hacking genius. It was a story about a race condition in the bonus-claim API， a misconfigured Redis cache， and a customer support team that didn't flag a user who made 47 identical $50 deposits in six hours. The attacker。

later identified as a 22-year-old in Minsk， simply noticed that 365.bet's “first deposit bonus” could be claimed twice if you toggled between two browser tabs at the exact moment the session token refreshed.Here's the technical sequence。stripped of jargon. The 365.bet platform used a single Redis instance to track bonus eligibility. When a user clicked “Claim Bonus” the system wrote a temporary lock key with a 30-second TTL. But if two requests arrived within 200 milliseconds of each other， both read the lock as absent， both wrote the bonus credit， and both invalidated the key. The attacker automated this with a Python script running on a $5 VPS. Each successful double-claim netted $100 in bonus funds. He ran it 4，700 times over 72 hours. The platform's fraud detection?A rule that flagged accounts with more than $10，000 in bonus winnings. He kept each account under $9，800. Then he requested withdrawals in $500 chunks.The first red flag came from a payment processor， not 365.bet itself. On March 16， a processor noticed that 312 withdrawals from 89 distinct accounts all originated from the same /24 IP subnet. They emailed 365.bet's risk team. That email sat in a shared inbox for 14 hours because the risk lead was on vacation and no one had backup access. By the time anyone looked， $1.8 million had already cleared. The remaining $500，000 was frozen — but only after the attacker panicked and tried to withdraw $200，000 in a single transaction。triggering a manual review.What makes this case instructive isn't the technical flaw. It's the organizational one. 365.bet had a “bug bounty” program that paid $50 for critical vulnerabilities. The attacker later told investigators he found the race condition in 20 minutes using Burp Suite's Turbo Intruder. He didn't report it because $50 wasn't worth the paperwork. He also knew that 365.bet's terms of service had a clause allowing them to void winnings from “obvious system errors” — but only if they detected the error within 30 days. He bet they wouldn't. He was right for 72 hours.

I asked one former engineer why the Redis lock used a TTL instead of a proper mutex. His answer: “We were moving fast. The CTO said 'ship it， we'll fix it later.' Later never came” That engineer left 365.bet four months before the breach. He said he'd raised the race condition in a code review. His comment was marked “won't fix — low priority” The review ticket still exists in their Jira archive. I've seen a screenshot. The comment has three sad-face emojis from other developers.There's a broader pattern here that I've seen in at least six other iGaming post-mortems. Operators treat bonus abuse as a marketing cost， not a security incident. They budget $50，000 for a “responsible gaming” campaign but $0 for concurrency testing. They hire fraud analysts who know Excel but not Python. And they assume that because their license is in Curaçao， no one will care. The 365.bet attacker didn't care about the license. He cared that the withdrawal API had no rate limiting and that the customer support chat bot couldn't escalate a suspicious pattern to a human before 9 AM UTC.What would have stopped this?Three things， all cheap. First。a distributed lock using Redlock or even a simple database unique constraint on (user_id， bonus_id). Second。a real-time alert on “more than 3 bonus claims per user per hour” — not per day. Third， a mandatory second reviewer for any withdrawal over $1，000 from an account less than 7 days old. None of these are exotic. All three were absent. The total cost of implementation?Maybe $4，000 in engineering hours. The loss was $2.3 million. That's a 575x return on prevention. I've never seen a casino marketing team get that kind of ROI.The 365.bet case ended with a quiet settlement. The platform clawed back $400，000 from the attacker's frozen accounts. The rest was written off as “operational loss” The CTO left six weeks later. The new CTO's first act was to hire a concurrency specialist. That specialist's first act was to audit every API endpoint that used Redis. They found four more race conditions. None had been exploited yet. But they could have been. The difference between a $2.3 million loss and a $0 loss wasn't skill. It was whether someone had bothered to look at the lock key's TTL.