{
  "id": "degen-spin-exploit",
  "url": "https://ohshit.app/incidents/degen-spin-exploit/",
  "title": "Degen Coin Flip pauses Spin and side bets after reporting a $10,000 house loss",
  "level": 4,
  "level_name": "septic-tank-blew",
  "date": "2026-11-06",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "Degen Coin Flip",
    "Solana",
    "Exploit"
  ],
  "ecosystems": [],
  "summary": "Degen Coin Flip says an exploit involving over 30,000 wallets cost its house about $10,000. It paused Degen Spin and side bets, says other games are unaffected and that player funds remain safe. The project has not published a root cause or verified fixed deployment.",
  "splash": "Degen Spin and side bets; the project attributes the approximately $10,000 loss to its house, not player balances.",
  "wipe": "Avoid Spin and side bets until the official fix and reopening are verified; preserve relevant round and transaction records.",
  "in_the_wild": "yes",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Wait for official reopening and fix details",
      "hint": "Use the project’s established announcement channel to verify the status of Spin and side bets before using them. The disclosure promises a return but gives no fixed version, contract address or deployment identifier; verify the eventual fix and reopening rather than treating the promise as completed remediation."
    },
    {
      "title": "Preserve relevant game records",
      "hint": "Keep round identifiers, timestamps, transaction signatures and wallet addresses for any unexplained outcome. Compare them with your own wallet records and contact support through an independently verified official channel. The project says players use their own wallets and it holds no player balances; this statement is not an independent audit of every transaction."
    },
    {
      "title": "Use the disclosed chain references in context",
      "hint": "The project links funding wallet 8JUEoHNMbWM4eegcMvx6ZQJt3V3fbo8JNjpWiCtJgxfF, collecting wallet 6LPotyCnDBy1uRu5F4CMoKhT7sMCS2mfFCo68cw9jFPi, and funding transaction NLgKpp9JqYGDz2mxw6Ruu8c2KKgXeAFB2p27JVGb4gx3YFk6dhaubkJYJEG3zVoaCycu3k3oDKSg7j9ebHQzmGP. Its funding reference is labelled Coinbase Hot Wallet; do not treat that shared service wallet as an attacker-only blocklist entry. A match alone does not prove compromise, ownership, cause or a loss. Do not sign unsolicited recovery requests or send funds to claim a refund."
    }
  ],
  "sources": [
    {
      "name": "Degen Coin Flip original incident disclosure",
      "url": "https://x.com/degencoinflip/status/2118555191599616042",
      "says": "Read in a public browser; project reports the exploited Spin feature, more than 30,000 wallets, about $10,000 house loss, affected-game pause and its player-funds assurance.",
      "primary": true
    },
    {
      "name": "Degen Coin Flip original funding-reference follow-up",
      "url": "https://x.com/degencoinflip/status/2118561375152930849",
      "says": "Read in the public conversation; identifies funding/collection references and an October 28 funding transaction. It does not establish a Coinbase security breach or the exploit start date.",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "The project confirms an exploited game flaw; the loss and wallet count are its estimates.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Nov 6, 04:04 UTC",
      "title": "Project discloses the exploit and pauses affected games",
      "body": "The original post reports over 30,000 wallets and about $10,000 of house losses; Spin and side bets are paused while a fix is developed."
    },
    {
      "date": "Nov 6, 04:29 UTC",
      "title": "Project shares funding and collection references",
      "body": "A follow-up links a funding wallet, a collecting wallet and an October 28 funding transaction. That date does not establish when exploitation began."
    }
  ],
  "body_markdown": "The project confirms an exploit in Degen Spin and says it paused Spin and side bets while working on a fix. Its approximately $10,000 loss and more-than-30,000-wallet count come from the operator, not an independent loss reconstruction. Wallets are not a count of distinct attackers, affected people or victims. The statement says the damage was borne by the house, players use their own wallets, and other games are unaffected. It does not establish a platform-wide wallet compromise or stolen player balances.\n\nL4 reflects confirmed active exploitation despite the limited reported house loss. The original disclosure does not explain the vulnerable logic, whether it is on-chain or off-chain, the full attack period, or an independently verified fixed deployment. The linked October 28 transaction is a funding reference, not proof of an attack starting that day. A Coinbase-labelled funding source does not establish an exchange compromise or responsibility for the exploit."
}