Skip to content
TORNLIFE More

XanFlip - the last letter

Started by systemd [4196484] on in Graveyard.

216 replies · 3.27k views · thread synced · 2 days ago · View on torn.com

Posts archived: 217 / 217 posts (100%) · the total is Torn's reply count + the opening post at the last fetch

systemd [4196484]

Service Notice: Crash exploit caught & patched

This past week we caught a player exploiting a race condition in our solo Crash game, firing multiple cashout requests in milliseconds against the same bet to credit himself up to 5x per win.

Cheater: Miladin [3948260]. Account disabled, balance zeroed.

Fix: Patched and deployed May 25. Every other solo game was code-reviewed, no other game had the same flaw.

Balance adjustments: A small number of accounts that held phantom-funded tokens had their balances adjusted. Our first sweep was too aggressive, several players who actually net lost money to him got clawed back when they shouldn't have. Those refunds have been issued. We also voided his pending tickets in the open Vanguard Pants raffle.

Every PvP outcome against him stands. The bug only affected solo Crash payouts. RNG and provably-fair commitments were untouched.

The operator is absorbing ~4,585 Xanax as the cost of the bug. If you notice a balance change you don't understand, an in-app modal will explain. If you still think we got it wrong, reply here or message me on Torn. 

If anyone has reason to seek satisfaction on his Torn profile, well, the link is right there.

Some proof (bets placed by him and cashed out multiple times): [image: i.ibb.co]

 

Mentions: Miladin [3948260]

Miladin [3948260]

I want to make a full public response because the current public narrative about me is incomplete, misleading, and has already caused serious damage to my Torn account and reputation.

 

First and most importantly:

I am not denying that a bug existed in Xanflip's solo Crash game.

 

If the ledger shown by systemd is genuine, then yes, the bug clearly existed and duplicate or even triple Crash payouts happened.

 

What I am denying is intent.

 

I did not knowingly exploit Crash.

I did not "hack" Xanflip.

I did not manipulate requests.

I did not use scripts, autoclickers, or any non-standard method.

I played through the normal site UI only.

 

That distinction matters.

 

A site-side bug existing is not the same thing as a player knowingly exploiting it.

A ledger showing duplicate payouts after the fact is not the same thing as proving that I noticed those payouts live and intentionally abused them.

 

That is the entire point of this post.

 

TLDR:

  • I am not denying that the Crash bug existed.
  • I am denying that I knowingly exploited it.
  • My large balance had a real PvP explanation, and systemd himself said all PvP outcomes stand.
  • I was high-volume playing Plinko + Crash with constantly moving animated balance numbers.
  • The ledger makes the bug visible after the fact, but that is not proof I noticed it live.
  • I did not cash out and keep 4,000-6,000 Xanax, and my networth graph contradicts that rumor.

 

Long version:

 

[image: i.ibb.co]

[image: i.ibb.co]

 

I also want to be very clear about something else:

 

The current public wording made many people believe that I somehow "walked away" with 4,000 to 6,000 Xanax and that I am currently sitting on a giant stockpile of stolen Xanax.

 

That is false.

 

The claimed site loss and the public rumor about what I personally "have" are not the same thing. The result of the public accusation has been a flood of bounties, attacks, enemy adds, chain target adds, hostile DMs, and even threats from people who now believe I am holding thousands of Xanax from a "heist".

 

That is not true, and my public networth graph makes that obvious.

 

[image: i.ibb.co]

21 May - 7.47b

22 May - 8.32b

23 May - 8.10b

24 May - 8.44b

25 May - 7.79b

26 May - 7.63b

 

This graph does not prove everything by itself, and I am not claiming that it does. But it does directly contradict the rumor that I personally cashed out and still hold a 4k-6k Xanax stockpile.

 

If I had actually extracted and kept 4,000 to 6,000 Xanax for myself, that would be reflected much more dramatically and much more permanently. Instead, what my networth graph shows is exactly what actually happened - money moving in and out through gambling, and continued play.

 

I also want to explain the full context, because without the context, some of my private chat messages to systemd may look bad or unserious.

 

---

 

1. THE "GOD MODE" / "ALWAYS BLUE" JOKE CONTEXT

 

---

 

Before systemd accused me privately, there was already an ongoing joke on Xanflip chat that I was "cheating", had "god mode", was the "house account", that I "always win", and that "blue always wins" whenever I played coinflip.

 

This was not about Crash.

This was about my ridiculous PvP luck streak, especially coinflip, and some raffle wins.

 

People were joking about it publicly in chat.

Even systemd himself saw it being discussed.

 

For example:

 

[image: i.ibb.co]

 

There were also multiple messages like:

 

  • "Miladin has god mode"
  • "Miladin is just the house account"
  • "Bro toggled the cheats fr"
  • "blue is ur lucky color"
  • "how is it blue 100% of the time"
  • "its only blue with u"
  • "Miladin always gets blue"
  • "Miladin gonna rob me"
  • "you just robbin me blind"

 

[image: i.ibb.co]

[image: i.ibb.co]

[image: i.ibb.co]

[image: i.ibb.co]

 

That is why when systemd first DM'd me and accused me, I did not initially take it seriously.

I thought it was another continuation of the same "god mode / cheating / always blue" joke that had already been happening in public chat for a while.

 

That was my mistake, but it is also important context.

 

My initial "Ah, the powerful god mode hahaha" response was not some confession.

It was me misunderstanding the situation because the exact same language had already been used jokingly in public chat.

 

[image: i.ibb.co]

[image: i.ibb.co]

 

---

 

2. HOW I WAS ACTUALLY PLAYING ON XANFLIP

 

---

 

The main reason I was playing so heavily was the rakeback / level system.

 

On Xanflip, the more you wager, the more you level up, and the higher your rakeback becomes.

So I specifically looked for the game that had:

  • high RTP
  • low variance
  • high max bet
  • and the ability to play extremely fast

 

For me, that game was Plinko.

 

Plinko let me:

  • bet up to 16,000 tokens per bet
  • place bets extremely fast
  • and even place them in parallel

 

I was literally spamming Plinko on low settings, very often as fast as I could click or tap.

Sometimes I was on desktop, sometimes on phone, sometimes using laptop plus phone, and sometimes playing on multiple screens (Crash on one, Plinko on the second) so I did not even need to alt-tab while playing both games (explanation of why Crash a bit later).

 

This was not hidden. I explained it publicly in chat.

 

[image: i.ibb.co]

[image: i.ibb.co]

 

I also explained publicly that this was how I got my level up so fast and why my rakeback was getting so high.

 

[image: i.ibb.co]

 

While doing that, I also played Crash in parallel.

 

Why?

Because Crash also allowed a relatively high bet amount - 5,000 max - and while waiting for Crash rounds to start or while preparing to cash out, I could keep spamming Plinko in between.

 

So my live play pattern was often:

  • spam Plinko constantly
  • place Crash bets in between
  • sometimes also play PvP, join Jackpot or Coinflip
  • all while the balance was moving constantly

 

That is crucial to understanding why I did not notice the Crash bug live.

 

---

 

3. WHY I DID NOT NOTICE THE BUG LIVE

 

---

 

This is the heart of the issue.

 

I am not saying the bug was not visible in a retrospective audit.

I am saying it was not something I noticed live while playing.

 

The difference between those two things is enormous.

 

What did my actual live gameplay look like?

 

Imagine a balance like 123,456 on screen.

Now imagine all of this happening continuously:

 

-16,000

-16,000

-16,000

+8,000

+16,000

+17,600

+33,600

-5,000

+6,7xx

-80,000

+39,000

+78,000

-40,000

+16,000

-16,000

 

And not once every few minutes.

Constantly.

At times, several balance updates could happen within a single second, depending on how fast I was clicking or tapping and how many Plinko balls were resolving.

 

Imagine dropping 20-30 Plinko balls, placing a Crash bet, and then continuing to drop more Plinko balls while waiting for the Crash round to start moving.

 

Some balls are being placed, some are still falling, some are resolving, Crash is running, and the balance number is animating up and down the whole time.

 

That was my normal gameplay environment.

 

If I had one clean, isolated Crash bet and one clean, isolated payout on a static balance screen, then yes, duplicate payouts might be easy to spot.

 

That is not how I was playing.

 

I was spamming Plinko like crazy.

I had 20-30 live Plinko balls on screen at any moment.

I was also placing Crash bets.

Sometimes joining Jackpot.

Sometimes playing coinflip.

My balance was constantly moving, and the numbers were animated.

 

On top of that, I did not even know a ledger page existed until systemd told me about it after accusing me.

I only looked at the ledger afterward.

 

And once I looked at it, yes - the duplicate Crash entries are visible in hindsight.

 

But hindsight is not live awareness.

 

[image: i.ibb.co]

 

[image: i.ibb.co]

 

Those ledger screenshots prove two things at once:

  1. The bug did exist.
  2. My balance environment during live play was chaotic enough that a retroactive ledger audit is not the same as noticing the bug live.

 

That is exactly why I reject the accusation of intentional exploitation.

 

The ledger proves a bug.

The ledger does not prove my intent.

 

---

 

4. MY BIG BALANCE HAD A LEGITIMATE PVP EXPLANATION

 

---

 

Another very important point is that I had a real and legitimate PvP upswing.

 

Systemd himself publicly stated that:

  • every PvP outcome against me stands
  • the bug only affected solo Crash
  • RNG and provably-fair commitments were untouched

 

Systemd says in his forum post: "Every PvP outcome against him stands. The bug only affected solo Crash payouts. RNG and provably-fair commitments were untouched."

 

This matters because one of the biggest assumptions people are making is:

"He deposited only a small amount, then later withdrew 1000 Xanax, so obviously he knew he was exploiting something."

 

That ignores the fact that I had major provably-fair PvP wins.

 

For example, against envytherose, I won three large coinflip matches in a row:

 

That is about +1,141,818 tokens of net profit from just those three matches alone.

That is about 1,427 Xanax worth of token profit.

 

[image: i.ibb.co]

 

I also had another strong PvP streak against Shadows:

 

That is another +641,194 tokens of net profit.

That is about 801 Xanax worth of token profit.

 

[image: i.ibb.co]

 

So between those two PvP streaks alone, I had about +1,783,012 tokens of legitimate net profit - about 2,229 Xanax worth.

 

That is exactly why a large balance did not automatically signal "something impossible" to me.

I had a real, public, provably-fair run of PvP wins.

 

This was not hidden.

People saw it live.

That is where the "Miladin always wins", "always blue", and "god mode" jokes came from in the first place.

 

[image: i.ibb.co]

[image: i.ibb.co]

 

So when I later had a large balance, I naturally attributed that to the combination of:

  • legitimate PvP wins
  • continued gambling
  • Plinko volume
  • rakeback
  • and ongoing wins/losses

 

I did not have a reason to think "Crash is secretly crediting me extra."

 

---

 

5. THE RAFFLE ISSUE

 

---

 

I know many players are especially angry about the raffle side of this, because I won a lot of raffle prizes.

 

What I actually won was 17 ranked weapons and 1 Private Island.

I understand why that looks bad to people, and I am not trying to minimize that part.

 

I understand that if some of my raffle ticket spending was funded by incorrect Crash credits, then that needs to be part of the audit.

 

I am not denying that.

 

But again, that is not proof of intent.

 

Raffles are random and proportional.

Nobody can honestly say with certainty which exact raffles I would or would not have won with a different ticket count, unless a full audit and settlement is done carefully.

 

And more importantly, even if the raffle side needs to be unwound or settled in some way, that still does not prove that I knowingly exploited Crash.

 

It only proves that incorrect credits, if any, may have flowed into raffle participation.

 

That is an accounting issue.

It is not, by itself, proof of deliberate cheating.

 

---

 

6. MY PRIVATE CHAT WITH SYSTEMD

 

---

 

After I woke up from a nap and saw systemd's message, the site was still in maintenance and I initially misunderstood the accusation because of the "god mode" joke context I explained earlier.

 

Then once I realized he was serious, I repeatedly said the same thing:

  • I did play Crash a lot
  • I did play Plinko a lot
  • I spammed both like crazy
  • if there was a bug, it was not intentional
  • I did not know I was being paid multiple times
  • I was willing to discuss how to handle the damage

 

That part matters a lot.

 

I did not say:

"Yeah, I found a bug and abused it."

I did not brag about it.

I did not deny the possibility of a bug once I understood what he was saying.

I explained how I had been playing and why I had not noticed it.

 

I also said that if raffle items had been won using bug-funded tokens, then of course that had to be addressed.

 

[image: i.ibb.co]

[image: i.ibb.co]

[image: i.ibb.co]

 

I may have misunderstood the accusation at first.

I may have reacted too casually at first because I thought it was another chat joke.

But that is not the same thing as intentional exploitation.

 

---

 

7. THE PUBLIC DAMAGE THAT FOLLOWED

 

---

 

This is the part that has affected me the most.

 

I am not claiming that systemd personally placed the bounties on me.

 

What I am saying is that:

  • he publicly named me
  • publicly called me a cheater
  • publicly linked my profile
  • publicly told people "if anyone has reason to seek satisfaction on his Torn profile, well, the link is right there"
  • put a site-wide modal in front of users repeating the same accusation

 

The predictable result was exactly what happened:

  • massive bounty spam
  • repeated attacks
  • long hospitalizations
  • target list adds
  • enemy list adds
  • hostile DMs
  • and even threats

 

This happened before there was any fair, calm, complete discussion.

 

[image: i.ibb.co]

 

"You currently have 27/30 targets on your list. 7 people have added you to their target list."

"You currently have 0/10 enemies on your list. 2 people have added you to their enemy list."

 

[image: i.ibb.co]

 

That proves exactly what the public understood:

they thought I had personally stolen and kept thousands of Xanax.

 

That is not true.

 

Even if I paid systemd tomorrow for the full amount he claims to have lost, that would not undo the damage already done to my Torn account because the public narrative is already out there and many players are now using me as a permanent bounty or chain target.

 

That is why this public response is necessary.

 

---

 

8. WHAT I AM ACTUALLY ASKING FOR

 

---

 

I am not posting this to pretend nothing happened.

 

I am not posting this to deny the bug.

 

I am posting this because the current public framing goes too far and accuses me of something that has not been proven - intentional exploitation.

 

Here is my position, as clearly as possible:

 

I accept that Xanflip's solo Crash game appears to have had a bug.

I accept that I may have received incorrect credits from that bug.

I do not accept that this proves I knowingly exploited it.

I do not accept being publicly branded a "cheater" or "hacker" without proof of intent.

I do not accept the false public impression that I personally walked away with and still hold 4,000 to 6,000 Xanax.

I was willing to discuss verified site-side damages in good faith.

But I was not given a fair chance to do that before the public accusation went live and the damage to my account started.

 

This is the part that makes the situation so difficult now.

 

Even if I paid systemd whatever number he believes is fair, I do not see how that fixes what has already happened.

 

The financial side of this is only one part of the damage. The larger problem now is that the public accusation created reputational damage that cannot simply be reversed by sending Xanax to systemd.

 

People now see me as a hacker.

People now see me as a cheater.

People now think I stole thousands of Xanax and still have them.

People are DMing me asking for a share of the "4k stockpile".

People have placed bounties on me.

People have added me to target lists.

People have added me as an enemy.

People have attacked and hospitalized me.

People have talked about finding my IP, DDoSing me, buying more bounties, and keeping me permanently hospitalized.

 

That is why this is not a simple "pay the operator and move on" situation anymore.

 

That does not mean verified damage should be ignored. It means the situation can no longer be treated as if the only damage that exists is systemd's accounting loss.

 

If the issue had been handled privately first, we could have discussed it properly.

 

We could have gone through the logs.

We could have separated legitimate PvP winnings from Crash duplicate credits.

We could have separated withdrawn Xanax from token balance, raffle tickets, raffle wins, losses, and open raffle exposure.

We could have calculated which part of the damage was real, which part was recovered, which part was still outstanding, and which part was impossible to fairly reconstruct.

We could have involved the relevant raffle hosts and affected players if needed.

We could have reached some kind of settlement based on verified accounting.

 

But that discussion never had a real chance to happen before I was publicly named and branded as a cheater.

 

And the accounting here is not simple.

 

This is not one clean transaction.

This is not "he took X and still has X".

This involves thousands of ledger entries, solo Crash credits, Plinko volume, PvP wins, Jackpot entries, raffle tickets, raffle wins, raffle losses, voided tickets, recovered balance, withdrawn Xanax, redeposited Xanax, and operator-side adjustments.

 

A fair calculation would take serious time.

It would probably require several people to review the same data.

It would require separating what was actually withdrawn from what was only internal token movement.

It would require separating legitimate PvP profit from bugged Crash credits.

It would require treating raffle outcomes carefully, because nobody can honestly know which exact raffles I would or would not have won with a different number of tickets.

 

Instead, the public saw "cheater caught", "profile link is right here", and "operator absorbed thousands of Xanax".

 

That framing created a mob reaction before any fair settlement discussion could happen.

 

So yes, I was willing to discuss verified damages.

 

But I am not willing to accept a situation where I silently pay a number just to cover systemd's side of the loss while the damage done to my account, my reputation, and my ability to play Torn normally remains completely unresolved.

 

Paying systemd may cover systemd's accounting loss.

 

It does not remove the cheater label from my name.

It does not remove the bounties already placed.

It does not remove me from people's target lists.

It does not undo the DMs, threats, Discord discussions, and public reputation damage.

It does not make people stop believing that I stole and kept 4,000 to 6,000 Xanax.

It does not repair the fact that I was publicly judged before intent was proven.

 

That is why I am asking for something more basic before any settlement discussion can be meaningful:

 

a correction or clarification that the Crash bug existed, but intentional exploitation was not proven

a clear distinction between "site-side loss", "raffle complications", "withdrawn Xanax", and "what I personally still hold"

removal or correction of the public wording that presents me as a proven hacker/cheater

an acknowledgment that the public post and modal caused a mob reaction against my Torn account

and only then, a fair discussion about verified damages based on actual accounting

 

I am not refusing accountability for verified damage.

 

I am refusing to accept a one-sided outcome where systemd's loss gets repaid, but the damage caused to me by the public accusation is treated as if it does not matter.

 

That is not a fair resolution.

 

---

 

9. FINAL WORD

 

---

 

I know some people will still say:

"Come on, how could you not notice?"

 

My answer is simple:

 

Because I was not sitting there studying a retroactive ledger.

I was high-volume gambling in real time, spamming 16k Plinko bets, 5k Crash bets, sometimes across different devices, with animated balance numbers constantly going up and down, after already having huge legitimate PvP wins that made a large balance feel normal rather than suspicious.

 

That is the truth.

 

The ledger proves a bug.

It does not prove that I knowingly exploited it.

 

I am willing to be judged on facts.

I am not willing to silently accept being turned into "the Xanflip hacker" when the actual evidence does not prove intent.

 

If anyone wants to discuss this in good faith, I am here.

systemd [4196484]

"If anyone wants to discuss this in good faith, I am here."

I offered you the possibility to refund just 50% of the chaos you caused. And the offer still stands up if you don't want to be on the xanflip homepage for new users.
I never said I'm not at fault too, that's why I am asking for just 50% of it.

"The evidence not prove intent":

Meanwhile:
[image: i.ibb.co]

You kept exploiting after the withdrawal: 450 more crash bets, 983 wins (218% rate), netting another 4.37M tokens. (Over ~5000 Xanaxes).

I gave you the full calculation in torn dms, but you still act like a child. Grow up and pay what you owe.

Floor:
Deposits sent to operator: 1,299 Xan
Paid withdrawals received: 1,600 Xan
──────────────────────────────────────────
Net Xan extracted to his Torn: 301 Xan

Middle: (half of raffle leak):
Total raffle ticket spend: 6,863 Xan
Less: max own funds (deposits): -1,299 Xan
Bug-funded raffle spend: 5,564 Xan
Less: Vanguard raffle voided (kept): -915 Xan
──────────────────────────────────────────
Bug-funded outflow to hosts: 4,649 Xan
Half of that (your share): 2,324 Xan

Total calcs:
Floor (net Xan extracted): 301 Xan
Half raffle leak: 2,324 Xan
──────────────────────────────────────────
TOTAL: 2,625 Xan


Edit 1: The same thing I told you now in Torn dms. Instead of wasting your time writing all of that. A simple "I'm sorry, I didn't realize, I want to make this right." was more than enough if you really want to make things right.

Edit 2: Related to the games you played against other users, they were funded by the phantom coins, I didn't took them in consideration since they were provably fair, even if they were funded by phantom tokens (yes it's true that the games should have never happened if you didn't inflate your balance)

Edit 3: Related to the bounties, It's not my fault, You didn't took me seriously, i told you I was gonna put a banner about what happened. You could have just said, ok it happened, let's fix this without making a big drama.

Edit 4: You didn't walk away with xanaxes, noone accused you of that. You ran away with RW items hosted by SuperGogu by using the phantom tokens you got from the crash exploit.
So it's useless to show us the networth. Show us your inventory with the RW items. Put them in your display case. Because these respect the market value, not their real RW value.

WEAPONS
- Tavor TAR-21 (18% Powerful)            - delivered 2026-05-22
- Beretta 92FS (17% Motivation)          - delivered 2026-05-22
- MP 40 (11% Revitalize)                 - delivered 2026-05-22
- P90 (16% Warlord)                      - delivered 2026-05-22
- AK74U (16% Warlord)                    - delivered 2026-05-22
- 9mm Uzi (16% Warlord)                  - delivered 2026-05-23
- MP5k (24% Proficience)                 - delivered 2026-05-23
- Enfield SA-80 (16% Warlord)            - delivered 2026-05-23
- Skorpion (16% Warlord)                 - delivered 2026-05-23
- ArmaLite M-15A4 (8% Expose)            - delivered 2026-05-23
- M4A1 Colt Carbine (18% Powerful)       - delivered 2026-05-24
- M16 A2 Rifle (56% Assassinate)         - delivered 2026-05-24
- AK74U (11% Revitalize)                 - delivered 2026-05-24
- Benelli M1 Tactical (17% Warlord)      - delivered 2026-05-24
- Enfield SA-80 (16% Powerful)           - delivered 2026-05-25

MELEE
- Macana (4T Disarm)                     - delivered 2026-05-22
- Diamond Bladed Knife (131% Wind-up)    - delivered 2026-05-24

PROPERTY
- Private Island (Happiness 2000)        - delivered 2026-05-24

So if i had no fucking heart whatsoever, I would ask you to return all of them, but to make everyone happy it's better to split the losses you caused with me. Even if it's not 100% fair.

Mentions: SuperGogu [3580072]

Shadows [3383077]

you clearly violated and abused the system, and you perposly spent ur exploited credits on raffles to hide ur networth, just pay it back. 

Edit, it was strange u magically was broke 1 second then u somehow had tens to hundreds of thousands of credits to drop. and u kept buying more raffle tickets than an item was worth.

Miladin [3948260]

I know my post was long, but this was already addressed.


The 1000 Xan screenshot only shows Torn transfers. It does not show the Xanflip gameplay between the deposit and withdrawal. Before that withdrawal, I had major PvP wins, including the three envytherose coinflips. Those were not Crash, they have replay links, and you yourself said all PvP outcomes stand.


Also, that 1000 Xan was not some "cash out and run" situation. I later sent almost the same amount back into Xanflip through deposits over the following days.


About "450 crash bets, 983 wins": yes, that proves the duplicate payout bug existed. I never denied that. If duplicate/triple payout rows are counted as wins, of course the win rate becomes impossible. That still proves the bug, not that I noticed it live or intentionally exploited it.


The "you did not take me seriously" part also ignores the timeline:

16:47 - I woke up and replied

16:48 - I was already mugged/hospitalized

16:53 - I was mugged/hospitalized again

16:57 - the actual serious discussion started

16:59 - you were already threatening the banner

17:02 - you repeated that the banner would go live

17:03 - first bounties were placed

17:08 - you wrote in Xanflip chat: "well if you want to get revenge on that guy, feel free to place bounties on him"


That is not a fair private discussion before going public. That is a few minutes while I was still realizing this was not another "god mode / always blue" joke, and the mob reaction had already started.


I already said I won 17 ranked weapons and 1 PI. I did not hide that. The question is whether the raffle accounting can be fairly reconstructed, and whether any of it proves intent. It does not.


My position is still simple: the bug existed, I may have received incorrect credits, I did not knowingly exploit it, and I was willing to discuss verified damage before being publicly branded a cheater and turned into a target.

Miladin [3948260]

Shadows, I get why it looked strange from the outside, but "broke one minute, hundreds of thousands the next" is exactly how Xanflip worked when you were playing PvP, Jackpot, raffles, and solo games at the same time.


For example, here is one ledger page:


[image: i.ibb.co]

That alone explains a jump from around 168k/200k to 529k/608k without needing any conspiracy.


I am not denying that the Crash bug existed. I am saying I did not notice it live and did not intentionally exploit it.


Also, saying I spent on raffles "to hide networth" makes no sense. I was openly joining raffles, openly playing PvP, openly talking in chat, and I already said publicly that I won 17 ranked weapons and 1 PI. I did not hide that.


The real issue is accounting: which raffle entries were funded by incorrect Crash credits, which were funded by deposits/PvP/Jackpot/normal balance, and what can be fairly reconstructed. That still does not prove intent.

Miladin [3948260]

Bro, please read more than three sentences before calling me a liar.

 

I already answered this.

 

Of course 3x payout is obvious when you look at a ledger after the fact and already know what you are searching for.

 

That is not live gameplay.

 

Live gameplay was animated balance numbers jumping constantly from 16k Plinko spam, Crash, Jackpot, PvP, and 20-30 Plinko balls resolving at the same time.

 

If you cannot understand the difference between "visible in hindsight" and "noticed live", then you are not arguing with my point, you are ignoring it.

 

I can ask systemd to let me deposit again or to credit me fake credits and screen record the same Plinko + Crash playstyle if that is what it takes.

 

The ledger proves the bug. It still does not prove intent.

systemd [4196484]

Ill just quote what i said.

You kept exploiting after the withdrawal: 450 more crash bets, 983 wins (218% rate), netting another 4.37M tokens. (Over ~5000 Xanaxes).

Now related to what you said:
"The real issue is accounting: which raffle entries were funded by incorrect Crash credits, which were funded by deposits/PvP/Jackpot/normal balance, and what can be fairly reconstructed. That still does not prove intent."

-----
well let's do some math!!!!!

https://pastebin.com/raw/czJK18Ka


 

systemd [4196484]

I wanted to be nice and solve this issue in a good manner. (and as i said I am sorry for the bounties, that was a bit extra, but consider that i wasted over 10 hours already, and a lot of users have been affected by this)

Now it's the time to decide, will you make this right or not?
Any other replies to this conversation are useless from this point since I provided the full audit.

Shadows [3383077]

bro ur so full of crap

#1006  2026-05-20 18:50  5 Xanax     4,000 tk
#1010  2026-05-20 19:11 10 Xanax     8,000 tk
#998 2026-05-20 18:10 1 Xanax 800 tk
#1128 2026-05-22 12:26 50 Xanax 40,000 tk


thats your deposits, so u deposted 12.8k creds up to the 21st.

then on the 21st 

#329   2026-05-21 20:15 requested   1,000 Xanax  800,000 tk   PAID 21:27


explain how u go from 12.8k deposited to withdrawing 800k

the proof of you exploiting and knowing full well you was is so obvious, stop lying and pay back what u exploited, even if systemd wont perma hosp u i will if u dont pay it back.

and dont say it was from pvp

   coinflip/series      456   224  17,045,839  17,198,052  +152,213


   jackpot               69    40   2,338,620   2,711,335  +372,715


   roulette              87    38   2,308,378   2,435,846  +127,468



cuz ur total profit on pvp games is less than the 800k withdrawl

Miladin [3948260]

Again, please read more than three sentences before repeating the same point.


Yes, the Crash bug existed. I never denied that.


Yes, duplicate Crash credits can be audited directly.


But the moment those tokens mix with PvP, Jackpot and raffles, it is no longer a clean "you owe X" formula.


For PvP, you cannot just say "this whole game should not count" because some part of the entry may have come from phantom balance. Simple example: if I entered a 500 Xan coinflip and I was missing 7 Xan worth of real tokens, then the accounting issue is that 7 Xan liquidity gap. It does not automatically make the entire 500 Xan entry, or the entire resulting win, fake. The fair calculation would need to track the missing amount, then continue from the actual fair PvP result.


The PvP result itself was still fair. If I won the 500 Xan coinflip, I won a fair PvP game. The question is not "delete the whole game", the question is "how much real balance was missing to enter it, and could I have deposited that difference?" I had 7-8b networth, so I was clearly capable of funding high stakes play legitimately if I needed to deposit more.


For raffles and jackpots, it is even less exact. More tickets or bigger entries increase odds, but they do not prove what would have happened with fewer tickets. I might have won some raffles with fewer tickets. I might have lost some with more. Nobody can know that retroactively with certainty.


That is why I keep saying this needs proper accounting, not "here is one number, pay it, and accept being called a cheater".


Shadows, you keep asking how I could be low balance one moment and have hundreds of thousands later (16 xan -> 1000 xan). I already showed a ledger example with zero Crash involved:


May 25, 14:55 - Jackpot bet -80,000

May 25, 14:56 - Jackpot win +31,200

May 25, 14:57 - Jackpot win +329,242

May 25, 15:15 - Jackpot bet -80,000

May 25, 15:16 - Jackpot win +156,000


That alone takes the balance from around 168k/200k to over 600k without needing a Crash bug. So no, "balance went up fast" is not proof of intent.

 

I also showed 3 games of 500 xan that I won.

Don't know why you are ignoring all that.


Also, the fact that you are now saying "even if systemd won't perma hosp you, I will if you don't pay it back" proves exactly why I said paying some number will not magically fix this.


Before this, I had no enemies, I was not a chain target, and I was not getting bounty waves. Now I am publicly branded as a cheater, people are threatening permanent hosp, adding me as target/enemy, placing bounties, and treating me as "the guy who stole thousands of Xanax".


Even if systemd and I agreed on a settlement amount, that does not undo the cheater label or the damage done to my Torn account. People would remember me as a CHEATER FOREVER.


So yes, let's separate the issues:

  • Direct duplicate Crash credits: auditable.
  • Downstream PvP / Jackpot / raffle impact: complex and partly probabilistic.
  • Intent: still not proven.
  • Public damage to my account: very real and still being ignored.
systemd [4196484]

i already said that i agree on you paying 2625 xanaxes which is more than fair
no math and no brain is required to see it that you caused more damage.


Direct duplicate Crash credits: auditable.
that's what we're talking for 2 days.

    date          bets   wins   staked      paid          net
    2026-05-20    76      73       74,900     129,444     +54,544
    2026-05-21    86     147      343,200     941,344    +598,144
    2026-05-22   188     434      936,000   2,892,959  +1,956,959
    2026-05-23   102     201      510,000   1,373,956    +863,956
    2026-05-24   156     339      780,000   2,283,773  +1,503,773
    2026-05-25     4       9       20,000      61,108     +41,108
    ─────────────────────────────────────────────────────────────
 

 

    TOTAL        612   1,203    2,664,100   7,682,584  +5,018,484


5million tokens generated from the crash exploit itself.
what im asking for is way below than the half of this amount itself.

Downstream PvP / Jackpot / raffle impact: complex and partly probabilistic. - i showed how much you gained from them in the pastebin link, the amount that was generated is a lot of times more than what you could have gotten from the pvp battles (guess what, also funded by crash wins.) 


Intent: still not proven. - you withdraw 1000 xanaxes, followed by winning a lot of fucking raffles


Public damage to my account: very real and still being ignored. - you did it yourself, not me

for the third fucking time, it is just hard to admit that it is also your fault, and just pay the requested amount of 2625 xanaxes?
the rest i already covered it by sending supergogu what i owed to him. and you keep playing as the victim in here.

i was also a victim pal, a victim of my own mistake yeah maybe, but also from your exploit and no judgement whatsoever


the difference is that, i paid up, and this has happened before too, a user reported that visually he should have earned more, i paid him what he was owed around 160k tokens (not much, but still). and the bug was fixed, no drama.



the main point is, ok you have a point too sure, but every single pvp game doesn't have anything to do with the amount i asked you to pay.
the amount generated from crash and how much you spent into raffles is all there.

don't take pvp in account for this. because you also caused user loses in there. and the hole would be even bigger
as listed in the pastebin

  game                bets  wins   staked      won           net
   coinflip/series      456   224  17,045,839  17,198,052  +152,213
   jackpot               69    40   2,338,620   2,711,335  +372,715
   roulette              87    38   2,308,378   2,435,846  +127,468
   ─────────────────────────────────────────────────────────────
 
   PvP TOTAL                                              +652,396


this is your total pvp winnings.


sorry for the numbers format, just go look it up inside the pastebin

systemd [4196484]

22:28:54 - 26/05/26 You were sent $1 from someone with the message: u r scemmer.... u will quite game...........

i clearly am a scammer for sure......

MaxYourSandals [4025877]

The damages you claim are only irreparable because you refuse to repair your (IMO) obvious exploits. 

 

You paid too much for lots of raffles, often near or over cost of the item itself. And you did this EIGHTEEN times 😂 In fact, you bid $626m for a default PI (which costs $500m). (read this wrong). A clear sign that someone knows they aren't playing with their own money. I have no doubt you recognized this was a convenient way to "wash" your ill gotten gains.

 

So now you want to keep it all AND play the victim, but you can't have it both ways.

 

Rest in bounties, bozo.

Miladin [3948260]

A few direct replies to the posts above.

 

To MaxYourSandals:

Your PI claim is factually wrong.

 

You said I "bid $626m for a default PI".

That is not what happened.

 

The whole PI raffle pool was around $627m. I did not personally pay that amount.

 

Actual PI raffle:

  • 1 ticket = 12,000 tokens = 15 Xan
  • I bought 15 tickets = 180,000 tokens = 225 Xan
  • Lawful bought 35 tickets = 420,000 tokens = 525 Xan
  • total pool = 600,000 tokens = 750 Xan
  • using 837k per Xan, my entry was around $188m
  • Lawful's entry was around $439m
  • I had 30%, Lawful had 70%
  • I won with 30%

 

[image: i.ibb.co]

 

https://xanflip.com/raffles/ce43bf0b9f

 

So no, I did not "bid $626m for a PI". The total raffle pool was around $626m. My personal entry was around $188m.

 

That is exactly why I keep saying accounting matters.

 

On that same day, I deposited 1,047 Xan into Xanflip:

 

09:17 - 250 Xan

09:36 - 48 Xan

13:50 - 280 Xan

15:28 - 120 Xan

16:04 - 100 Xan

20:55 - 199 Xan

22:57 - 50 Xan

 

[image: i.ibb.co]

 

My PI entry cost 225 Xan worth of tickets. I deposited 1,047 Xan that day.

 

Maybe those exact 225 Xan were fully funded by deposits / normal wins. Maybe partially. Maybe they included duplicate Crash credits. That is the accounting question. It is not answered by falsely saying I paid $626m for a PI.

 

To systemd:

[image: i.ibb.co]

 

You keep saying I "can't admit I have part of the fault".

 

I already did. Multiple times.

 

  • I said the bug appears to have existed.
  • I said I may have received incorrect credits.
  • I said if raffle items were funded by bugged credits, that should be addressed.
  • I said I was willing to discuss verified damage.

(all of these are already in my first reply + some of them are repeating in other replies, don't want to spam with more images)

 

But admitting there is damage to discuss is not the same as admitting intentional exploitation.

 

That is the part you keep skipping.

 

You also keep saying "you keep bringing up PvP".

 

Yes, of course I bring up PvP, because you and others keep using the 1000 Xan withdrawal and the later balance as proof that I "obviously knew".

 

Before that 1000 Xan withdrawal, there were large provably-fair PvP wins. You yourself confirmed that PvP outcomes stand and RNG was untouched.

 

And most of that withdrawn Xan was later sent back into Xanflip through deposits. It was not "cash out and run".

 


 

Now, about the amount.

 

I am not refusing accounting.

 

I am refusing blind payment while the numbers and methods keep shifting.

 

So far I have seen: 
  • "around 4620 Xan"
  • "5,006,305 tokens / ~6258 Xan from Crash payouts"
  • "almost 9000 Xan"
  • 2,625 Xan as the requested settlement
  • pastebin saying around 5,556 Xan owed

 

[image: i.ibb.co] [image: i.ibb.co] [image: i.ibb.co] [image: i.ibb.co] [image: i.ibb.co] [image: i.ibb.co]

 

If you want proper accounting, I am open to proper accounting.

 

For now, these numbers appear to be based on different methods, aggregate assumptions, and possibly some guessing, and they keep shifting with each message. That is not surprising, because proper accounting here would probably take days.

 

The problem is that I was publicly framed as a cheater before that accounting process happened.

 

You did not wait even 15 minutes for a real private discussion before the situation started turning public, and almost immediately after that came attacks, bounties, enemies, target adds, and rumors.

 

So yes, I am skeptical that proper accounting will actually happen now. If there was not enough time for a calm private discussion before publicly branding me as a cheater, I do not see how I am supposed to trust that there will now be days of careful game-by-game tracing through deposits, Crash credits, PvP, Jackpot, raffles, withdrawals and redeposits.

 

 

But if the position is "do not trace it properly, just trust my number and pay blindly", then I am not accepting 2,625 Xan as a proven number.

 

If this is a blind settlement, my counteroffer is half of that: 1,312 Xan.

 

That is not an admission of intentional exploitation.

That is not me accepting the "cheater" framing.

That is simply a settlement offer if everyone refuses proper tracing and just wants this ended.

It is not me agreeing that your calculation is correct.

 

But any payment must also come with public correction and removal of the cheater framing.

 

Because paying any amount does not undo the homepage/modal, the bounties, the target lists, the threats, or false claims like "he bid $626m for a PI".

 

So my position is simple:

  • proper accounting first, or if everyone insists on a blind settlement, my offer is 1,312 Xan
  • any settlement requires public correction/removal of the cheater framing
  • direct duplicate Crash credits are auditable
  • downstream raffle / Jackpot / PvP impact is not clean without tracing
  • intent is still not proven
Miladin [3948260]

TLDR because this is long and people clearly do not read everything:

  • I did not bid $626m for a PI. The whole raffle pool was ~$626m. My entry was 225 Xan / ~$188m, and I won with 30% odds.

  • That same day I deposited 1,047 Xan, while the PI entry cost 225 Xan. This is exactly why proper accounting matters.

  • systemd's numbers keep shifting: ~4620 Xan, almost 9000 Xan, ~6258 Xan from Crash payouts, 2,625 Xan settlement, pastebin ~5,556 Xan owed.

  • I am open to proper accounting, but not blind payment based on shifting numbers.

  • If this is a blind settlement, my counteroffer is 1,312 Xan.

  • Any payment must come with public correction/removal of the cheater framing.

  • Bug existed, accounting damage may exist, intent is still not proven.

systemd [4196484]

Fair points, let me address them in order and then put a single coherent number on the table.

On intent vs. damage. You're right that there's a difference between admitting damage and admitting intent. I don't need to prove intent to ask for the damage to be returned, the principle "money I should never have been paid goes back" applies regardless. So I'm going to set the intent debate aside and focus on the dollar number, which is the part either of us can actually verify. For the record though: the bug paid you roughly double per cashout for six consecutive days across 612 placed bets. Your balance trajectory across that window does not fit a player who genuinely wasn't watching their wallet.

On the PvP "everything was fair" claim. The coinflip RNG was untouched, that's true. But the bankroll you used to place those large coinflips was inflated by the exploit credits. The three 400k stakes you ran on 2026-05-21 at 19:50, 19:55 and 19:56 were possible only because the exploit-doubled crash credits had pushed your balance up earlier that day. Without the exploit your wallet at 19:50 couldn't have covered a 400k bet.

So "PvP outcomes stand" is true at the RNG layer. It doesn't mean the wagered amounts were money you would have had access to in a non-bugged world.

On the shifting numbers. I owe you a clean reconciliation. The numbers you quoted came from different framings of the same exploit, and I should have been clearer about which is which:

4,620 Xan: early gross-payout estimate before subtracting your legitimate stakes. Wrong, supersede.
5,006,305 tokens (~6,258 Xan): gross crash payouts. Doesn't deduct stakes. Right number, wrong framing.
~9,000 Xan ("inflation"): was me being nervous. Disregard.
2,625 Xan (the table I sent): "direct Xan extracted + half-raffle leak." Conservative because it assumes you ate only half the raffle downstream damage.
5,556 Xan (pastebin): the rigorous number. This is (solo_crash_win minus solo_crash_bet plus solo_crash_cancel = +5,023,484 tokens net exploit gain) minus the +578,265 admin_adjust already clawed back, converted at 800 tokens per Xan.

That last one is what I'm standing on.

The pastebin is the source-of-truth audit. It's pulled directly from the ledger, it shows you the bet/win counts that prove the bug existed (612 bets, 1,203 wins, a wallet-layer double-credit), and it shows every deposit, every withdrawal, every raffle item, line by line. Nothing in there is estimated.

On the public framing. This is the point you're most right about. Going public before a private discussion concluded was wrong on my end. I'll commit to:

A public correction acknowledging the public framing pre-empted private accounting and walking back the "obviously knew" language.
Removing the homepage/modal references on settlement.
Stating publicly that the exploit was a wallet-layer double-credit bug, not a player-side RNG attack.

I'm not going to retract the existence of the exploit or the amount owed. I will retract the word "intentional" because I can't prove it as a forensic matter, and the audit doesn't require me to. I do want to be clear what "cannot prove intentional" means in this case though. A wallet that consistently pays double for six days while a player keeps placing 100+ bets per day, withdraws 1,000 Xan partway through, then comes back and grinds another 4M tokens out of the same broken cashout flow, is a pattern that anyone watching their balance would have noticed within an hour. The audit doesn't compel me to call that intentional. It also doesn't ask me to pretend it was plausibly invisible.

On the 1,312 counter. I can't accept halving the already-conservative 2,625. The 2,625 figure already gave you the benefit of the doubt on the raffle side (split 50/50 because the downstream tracing is genuinely hard). The 5,556 figure is the one the ledger actually supports.

My final position:

Settlement target: 5,556 Xan (the auditable, ledger-derived number).
Open to negotiation between 2,625 and 5,556 if you want to challenge specific line items in the pastebin. Give me which lines and why, and I'll re-run them.
On payment: public correction and framing walk-back happens the same hour the payment lands. Both in writing.
The full audit is at the pastebin link. If you want a different methodology, propose one and I'll compute it.

If "proper accounting" means "challenge the line items in the pastebin one by one," I'm open to that and it doesn't take days, it takes a thread of specific objections to specific numbers, which I will answer with raw SQL output from the ledger.

If your offer is "1,312 with no further accounting," we don't have a deal.