Theldu.to - News

Dear supporters.

We are reaching out to share a serious issue that has recently come to light regarding donations made to our site. Our commitment is to be fully transparent with you about what happened, acknowledge our mistakes, and outline the steps we’re taking to ensure this doesn’t happen again. We deeply value your trust and support, and we hope to maintain it moving forward.

What Happened

Our Initial Setup: Before launching the site on January 1, 2024, we generated offline cryptocurrency wallets and air-gapped them from the site to enhance security. These physical wallets were stored in a vault with access restricted to just one person. To minimize risks, we planned to sweep the wallets and recreate new ones only once per year, limiting transactions.

The Security Breach:

Between Feb-March 2024, our site—then hosted on a different server and domain, and a less secure version of Unit3d—came under heavy attack. In response, we rebuilt the site on a new domain (.to) by March 28, 2024. During this rebuild, we made a critical error: instead of retrieving the correct public addresses from the physical wallets in the vault, we copied them from a backup of the original site. At the time, we believed this would reduce unnecessary trips to the vault. Unfortunately, those addresses had already been replaced by someone else's with what looks like a SQL injection.

The Discovery:

Recently, with our petty cash reserves running low, we went to sweep the wallets. That’s when we found that the addresses on the site didn’t match those in the vault. After investigating chat logs and backups, we confirmed that the addresses were altered during the attacks last year, before the rebuild. This means that when we copied the addresses to the new site, we unknowingly used the hijacked ones. The attackers swept those funds just three weeks ago. Our Mistake We take full responsibility for this operational security failure. Despite our efforts to air-gap the wallets and limit access, we failed to verify the addresses against the physical wallets during the site rebuild. This oversight allowed donations to be sent to compromised addresses, resulting in their loss.

Steps We Are Taking

Immediate Correction: We’ve updated the site with the correct addresses from the vault’s physical wallets.

Improved Processes:

Going forward, we will: Continue air-gapping wallets and restricting vault access to one trusted individual. Sweep wallets more frequently to catch discrepancies earlier. Regularly cross-check the site’s addresses with the physical wallets. Explore additional safeguards, like real-time monitoring tools, to strengthen our security. Current Site Safety: The flaw that allowed this breach was on an old server running much different version of unit3d software. Access to the the site and DB are limited to very few people at this point. No one will every become mod except the original staff. The Currently listed addresses have been updated and confirmed to match what we have in the vault. Impact on Donations Sadly, the donations sent to phony addresses over the past year are lost. We deeply regret this and understand it may shake your confidence in us. Please know we’re committed to learning from this and preventing future losses.

Moving Forward

Transparency:

We’re sharing this full account because we believe in being open with our community. Security Commitment: We’re dedicated to protecting your contributions and will keep improving our safeguards. Your Support: Despite this setback, we remain focused on our mission. We humbly ask for your continued support—whether through new donations or simply staying with us—as we work to rebuild and move forward. We sincerely apologize for this incident and any concern it causes. Your trust means everything to us, and we’re taking every step to ensure this doesn’t happen again.

Thank you for your understanding and support through our journey. For those looking for drama we already expect a pile on and trashed by the reddit fireingsquad. We would rather be open and honest about a mistake we made and how it happened. Other trackers can learn so the community can win.

Warm regards,