Skip to content
Archive

Post

Back to deliverables

jheioff
第一美少女
@jheioff

4/10 三、Gate公开回应前后矛盾 1. 关于Google验证器 Gate公开称,攻击者在“重设Google验证器”时,通过了“前一个Google验证器”的验证。 但安全日志清楚显示,原Google验证器是先被取消,之后才重新启用新的验证器(附图一)。Gate需要解释:一个已经被取消的Google验证器,如何用于验证新的Google验证器? 2. 关于视频证据 Gate在7月8日公开称(附图二): 7月4日收到邮箱及本人视频; 7月5日收到手持证件和纸条视频,并由客服完成核验; 7月7日完成活体人脸认证并提币。 此前Gate明确表示相关视频已经保存,现在又称因涉及活体生物信息,无法保存。且gate虚假宣称向警方提供了所有活体验证结果和资料,实际只提供了手持身份证人像自捞,无视频资料。 同一批关键证据,Gate需要时就称“已经保存”,被要求出示时又称“根本不能保存” 这是藐视司法权威!

photo photo

· 12K Views

2 Reposts 37 Likes 1 Bookmarks
replies reposts likes
2 replies collected of 3 X reports
第一美少女 @jheioff ·

5/10 IV. Gate provided misleading information to the police, disrupting the investigation 1. Gate told the police that "between July 4th and 8th, the platform sent verification codes to my phone number and email address. After all verifications were successful, the user reset the security settings themselves." This statement would mislead the police into believing that my email address, phone number, or device had been compromised. However, the actual security logs show that my email address, phone number, login password, funds password, and Google Authenticator were all subsequently modified or reset. The attacker verified the security settings that had been changed, not my original email address, phone number, and Authenticator. 2. Gate also claimed that "on July 6th, when the user changed their login password, funds password, and Google Authenticator, they verified both the email verification code and the funds password." However, the email address and funds password had already been changed by the attacker at that time, and these verifications could not prove that the account holder had performed the operation. Gate's statement deliberately obscures the distinction between "original security settings" and "security settings reset by the attacker," directing the police investigation towards "user email or device infection," thus concealing the real issue: Gate's manual verification allows attackers to bypass the user's original authentication, reset all security settings, and transfer all account assets. Gate cannot bypass my original security verification while simultaneously shifting responsibility to the user. 3. My Mac computer contains Gate's access key; I can log in simply by pressing my Mac keyboard fingerprint, and there are no abnormal pop-up alerts after logging in. Gate's initial accusations that I logged in using an old device and that my old device was stolen are baseless. All my old devices are with me and in good condition. Having used Web3 for so many years, it's common sense that I wouldn't sell or discard old devices. Gate is disrupting the correct investigative direction, delaying the attacker's investigation, and obstructing judicial fairness.

original · zh

5/10 四、Gate向警方提供了误导性信息,扰乱侦查方向 1.Gate向警方称“7月4日至8日期间,平台向我的手机号和邮箱发送验证码,在全部验证通过后,用户自行完成了安全项重置”,这种表述会让警方误以为,我的邮箱、手机号或设备已经被控制。 但实际安全日志显示,我的邮箱、手机号、登录密码、资金密码和Google验证器,都是在后续被陆续修改或重置的。攻击者验证的,是其已经更换后的安全项,并非我的原有邮箱、手机号和验证器。 2.Gate还称“7月6日用户修改登录密码、资金密码和Google验证器时,均验证了邮箱验证码和资金密码”,但当时邮箱和资金密码早已被攻击者修改,这些验证根本不能证明是账户本人操作。 Gate的表述刻意模糊了“原安全项”和“被攻击者重置后的安全项”,将警方调查方向引向“用户邮箱或设备中毒”,掩盖了真正的问题:Gate人工审核允许攻击者绕过用户原有验证,重置全部安全项,并转走账户全部资产。 Gate不能一边绕过我的原有安全验证,一边又把责任推给用户 3.我的mac电脑保存有gate的通行密钥,只需要按一下mac键盘的指纹就能登录,且登录后没有异常弹窗提醒,gate前期指控我旧设备登录,指控我旧设备被盗是无稽之谈。 我的所有旧设备都在身边保存完好,在web3这么多年不会卖掉或者丢弃旧设备,这是常识。 gate扰乱正确的侦查方向,为攻击者拖延时间,妨碍司法公正

2 36
Nic @fornicv ·

@jheioff I think I understand now. To evade regulation, they didn't use the official facial recognition channel. As a result, their own facial recognition channel, which uses a combination of manual and machine recognition, was "reasonably" bypassed. Why is it considered reasonable? Because this recognition technology is not cheap, and to save money, they could simply use AI recognition, which just tells you a so-called percentage. And internally, the redundancy in this percentage is probably quite extensive.

original · zh

@jheioff 我大概明白了,他们为逃避监管,没用官方的人脸验证通道。结果自己的人脸通道是手工+机器识别,被“合理”绕过了。 为什么说合理?因为这种识别技术成本不低,为了省钱可以简单的用AI识别,AI识别就是告诉你一个所谓的百分比。 而他们内部对于这个百分比的冗余可能挺宽泛。

3 replies whose parent comment X withheld

第一美少女 @jheioff ·

7/10 VI. Gate claims to be cooperating with the police, but where are the leads? Gate has repeatedly stated publicly that it is "fully cooperating with the police" and "has obtained a large amount of information." However, as far as I know, Gate has not yet provided the police with any information that could effectively pinpoint the attackers. If you truly possess a large amount of information, why not immediately and completely submit it to the police to assist in apprehending the attackers? True cooperation is not about releasing public relations statements, but about handing over the evidence you have to the police. Is this delay in providing information an attempt to protect the attackers?

original · zh

7/10 六、Gate 声称配合警方,线索在哪里? Gate 多次公开表示“全力配合警方”“已经掌握大量线索”。但据我目前了解,Gate至今没有向警方提供能够有效锁定攻击者的线索。 如果你们真的掌握了大量线索,为什么不立即完整提交警方,协助警方抓获攻击者?真正的配合不是发布公关文章,而是把掌握的证据交给警方。 迟迟不提供,难道是在保护攻击者吗?

2 30
第一美少女 @jheioff ·

8/10 VII. Gate, please conduct an authoritative verification of the risk control materials immediately. Gate, please provide a direct answer regarding the verification time; this is the most important point. Don't try to explain further. Please have Gate submit the original materials submitted by the attacker—the ID card held in hand, the live face video, and the complete review records—to a qualified independent and authoritative institution for verification. My stance is very clear: If the verification proves the ID card held in hand is genuine and valid, and the person in the live face video is indeed me, I will no longer pursue legal action against Gate and will issue a public apology. Conversely, if the verification confirms the ID card is forged, the live face is not mine, and the withdrawal was not made by me, this is sufficient proof that the attacker used false materials to breach Gate's verification and risk control system. Gate has publicly promised: "If it is the platform's responsibility for verification, 100% compensation will be provided." If the verification confirms that fake materials and a non-person's live face passed the platform's verification, please have Gate immediately fulfill its promise, assume responsibility, and provide 100% compensation to users for their losses. The beastly Gate must stop creating controversy and insinuating against users.

original · zh

8/10 七、请gate立即进行风控材料的权威鉴定 gate 请正面回复去鉴定时间,这是最重要的,别扯其他的,请 Gate 将攻击者提交的手持身份证原始材料、活体人脸视频及完整审核记录,交由具备资质的独立权威机构鉴定。 我的态度非常明确: 如果鉴定证明手持身份证真实有效,且活体视频中的人确实是我本人,我将不再向 Gate追责,并公开道歉。 反之,如果鉴定确认身份证系伪造、活体人脸并非本人、提现也不是本人操作,就足以证明攻击者利用虚假材料击穿了 Gate 的审核和风控体系。 Gate 已经公开承诺:“如果属于平台审核责任,100%赔付。”如果鉴定确认假材料和非本人活体通过了平台审核,请 Gate 立即兑现承诺,承担责任并 100%赔付用户损失。 畜牲Gate 必须停止制造话题、影射用户

2 49
第一美少女 @jheioff ·

On October 10th, Gate.cn didn't directly respond to when they would implement "ID card hand-held material + liveness video verification." Instead, they kept throwing out claims like "honey trap," "insider theft," and "two Alipay accounts stolen," implying victimized users and diverting public attention. Gate.cn is a master of lying, shirking responsibility, blaming users, saying one thing and doing another, lacking accountability, contradicting themselves, and delaying action. Gate.cn is a pile of risk control garbage disguised as an exchange: their pre-incident checks are practically non-existent, and afterward they turn a deaf ear, refusing to submit evidence or admit responsibility, only capable of spreading rumors, shifting blame, and confusing the public. Money was transferred from their platform using fake information and by unregistered individuals, yet they turn around and blame the users—both incompetent and shameless. Their so-called "security" is a joke, and their so-called "100% compensation" is utter nonsense. Gate.cn doesn't deserve to talk about risk control; they only deserve to be nailed to the pillar of shame in the cryptocurrency world!

original · zh

10/10 Gate 没有正面回复什么时候去做“身份证手持材+活体视频认证”,反而不断抛出“仙人跳”“监守自盗”“两个支付宝被盗”等说法,影射受害用户、转移公众视线 这 gate真是胡说八道一流,推卸责任一流,指责用户一流,说一套做一套一流,没有担当一流,前后矛盾一流,推诿拖延一流 Gate就是一坨披着交易所外衣的风控垃圾:出事前审核形同虚设,出事后装聋作哑,证据不交、责任不认,只会造谣、甩锅、混淆视听。钱在你们平台被假资料和非本人活体转走,你们却反咬用户,既无能又无耻。所谓“安全”是笑话,所谓“100%赔付”就是放屁。 Gate不配谈风控,只配被钉在币圈耻辱柱上!

3 74

These were collected in full; the comment they answer was not returned by X.