TF2Hunt Incident report 2026.09.28

People get lucky, we are okay with it. One of our users has won quite a noticable amount on Plinko a few weeks ago. After initially verifying just the database outcomes, we've finalized his bets and completed his payout.

This was a 5 figure payout we've completed, the likelyhood of someone winning this big was very very very very low, hitting 0.026% bets over and over again. It did take more time than intended as this very very rarely happens, sorry for that, but in the end we delivered, like we should, should't be mentioned.

This same user today, on 2026.09.28 has returned and once again did the impossible, ran it up the same way he did weeks prior.
To anyone who knows odds and probabilities, this is impossible. I don't even want to begin calculating the odds of this, mostly because it's not needed as this turned out to be a bug exploit.

I went ahead and dove further, instead of double-checking the database to see the seeds, I actually ran the plinko multiplier generation algorythm and passed his client seed, server seed and nonces.

This immediately showed the issue. It just wasn't adding up, and it was an issue on our end, abused by the user. Turns out the randomized server seed, when you regenerated your client seed, wasn't being passed in your plinko games.

So if your client seed was "insanelylucky" and your server seed was "qwerrasdfghjkyxcvb" and your nonce was 1, your plinko seeds would be generated with this seed:

insanelylucky-qwerrasdfghjkyxcvb-1

And then -2 -3 as you play more games.

With this error, the middle part was skipped after the seed change, so purely the user seed was used for the generation, so:

insanelylucky-1

So if you played enough games with your seed to hit a 120x, 1000x, you knew your 542nd game would pay out big, we'd be generating the outcomes based on your input. I feel stupid for not noticing this sooner.

All you had to do is change your seed to something random, play the mandatory games required so you can change it again to a seed where you already know the outcomes and then play X games to once again hit the 100% guaranteed high payout. And repeat until you're caught.

This is what this person did, once he found out he is literally replaying his previous games, getting the same outcome.

There is literally no justification for what this person did, they abused the system. For this reason, I've removed the abused funds from the account.

We are not going to pursue any legal action towards the abuser, I am not looking to expose this user or report them to any market to stop the stolen funds from leaving the economy, since most of their first 5 figure win was completely legitimate. We want to report the incident and just be done with it.

As always, users are safe, the issue has been patched.

I privately reached out to this user to let them know the abuse is now over, I did not expect them to act the way they did, act dumb and threaten us, but it is what it is. There is just literally no way this user didn't know they were getting the same outcome. Their argument was invalid and in the end he blocked me, not the other way around like you'd expect this to go if we really wronged someone and wanted to hide it. I just wanted to release our statement in response to the "evil casino is not paying me" lies.

Some Logs:

[2026-09-16T04:36:04.245] [INFO] default - SEED CHANGE 76561198032xxxxxx oughh
[2026-09-17T03:25:27.061] [INFO] default - SEED CHANGE 76561198032xxxxxx idfkk
[2026-09-18T11:52:38.092] [INFO] default - SEED CHANGE 76561198032xxxxxx oughh
[2026-09-23T01:47:16.890] [INFO] default - SEED CHANGE 76561198032xxxxxx idfkk

..

[2026-09-27T05:56:55.885] [INFO] default - SEED CHANGE 76561198032xxxxxx oughh
[2026-09-28T01:23:32.896] [INFO] default - SEED CHANGE 76561198032xxxxxx oughh

At least he had some humor inbetween doing the exploit:

[2026-09-27T06:07:59.110] [INFO] default - SEED CHANGE 76561198032xxxxxx idontknowman
[2026-09-28T01:15:40.198] [INFO] default - SEED CHANGE 76561198032xxxxxx riggedasf
[2026-09-28T01:17:39.516] [INFO] default - SEED CHANGE 76561198032xxxxxx fuckedup

The user used the "oughh" seed 5 times to exploit the same max win and the "idfkk" seed 3 times to get a max win. Turns out it was "riggedasf", in his favor and he abused it for a lot of cash. Not anymore.

We do not wish to comment further on this topic, we wasted enough time and money on an abuser, we took the L and we're right back to working on releasing our updates.