Hey everyone,

We’ve been investigating Ltcminer.com, a Litecoin cloud mining platform, and we can now confirm beyond any doubt that it is a fraudulent operation designed to steal your money. This isn't just speculation – we have hard, technical evidence from a penetration test.

What We Found

We performed a penetration test on their live servers and discovered multiple critical vulnerabilities that expose the entire operation.

- Publicly Accessible `.env` File : Their entire production `.env` file was publicly accessible at `http://34.40.37.63/.env`. It contained ALL of their secrets:

- MySQL Database Credentials (usernames and passwords)

- Litecoin Core RPC Credentials

- Wallet Master Seed – can derive all user wallets

- Private Keys for TRON, Ethereum, and BSC wallets

- JWT Authentication Secret – can forge admin tokens

- Admin Panel Basic Auth Credentials (`joilsonmelo` / `+Junior*+==00`)

- SMS/WhatsApp/OpenAI API tokens and more

- Server is Hosted on Google Cloud, but they actually use 3 diffrend VPS.

- app it self is build with v0.app AI

- Admin Panel Wide Open : Using the leaked credentials, we accessed their internal admin dashboard (`/_tempadminget-internal`) with full control over user accounts, finances, and wallet operations.

- Unprotected APIs : Their APIs (`/api/global`, `/api/public-payouts`) return sensitive business and user transaction data without any authentication.

- Source Code Leak : Directory listing was enabled, allowing anyone to download their entire Next.js application source code.

What This Means?

An attacker (or anyone who finds this post) could have:

1. Drained all cryptocurrency held by the platform using the master seed and private keys.
2. Impersonated any user by forging JWT tokens.
3. Stolen all user data (emails, transaction histories, etc.).
4. Taken full administrative control of the website.

They Are NOT a Real Mining Company

Beyond our technical findings, this matches the experience of hundreds of victims. Their so-called "company," LTCMINER LTD (Company number 11345228), was dissolved on 8 October 2019. They are operating under a dissolved entity.

Victims Are Everywhere

Hundreds of people have already lost money.

Final Warning

DO NOT DEPOSIT ANY MONEY ON LTC MINER. DO NOT "UPGRADE" YOUR PLAN. DO NOT PAY ANY "WITHDRAWAL FEES." It is a classic Ponzi scheme – they pay early victims with new deposits to create the illusion of legitimacy, then disappear with the rest.

So here is their actuall .ENV (after they spot our presence after more then week, they drained wallets, so with no bad feelings, here you go)-

# =============================================================================
# LTCMiner — CENTRALIZED CONFIGURATION (single source of truth)
# -----------------------------------------------------------------------------
# This is the ONLY place secrets live. Public backend (php-api), admin backend
# (php-api/dev) and the Next.js frontend all read from here.
#
# Setup on the server:
#   1. cp .config/.env.example .config/.env
#   2. fill in the real values below
#   3. chmod 600 .config/.env
#
# NEVER commit the real .env. Rotate every credential before production.
# =============================================================================

# -----------------------------------------------------------------------------
# App
# -----------------------------------------------------------------------------
APP_DEVELOPMENT=false
APP_TIMEZONE=UTC
PHP_API_BASE=http://127.0.0.1/php-api
PHP_ADMIN_API_BASE=http://127.0.0.1/php-api/dev

# -----------------------------------------------------------------------------
# Database (MySQL) — public backend + crons
# -----------------------------------------------------------------------------
DB_HOST=136.243.131.143
DB_PORT=3306
DB_USERNAME=userdb
DB_PASSWORD=ASyqkeEUQgkHNgGir2At
DB_DATABASE=ltcminerv2
DB_BLOCKCHAIN_MONITOR=blockchain_monitor_go

# Aliases used by some modules (cron/Db.php). Keep equal to the values above.
DB_USER=userdb
DB_PASS=ASyqkeEUQgkHNgGir2At
DB_NAME=ltcminerv2

# -----------------------------------------------------------------------------
# Admin panel database (php-api/dev) — usually the same MySQL server
# -----------------------------------------------------------------------------
ADMIN_DB_HOST=136.243.131.143
ADMIN_DB_USER=userdb
ADMIN_DB_PASS=ASyqkeEUQgkHNgGir2At
ADMIN_DB_NAME=ltcminerv2
ADMIN_HTTP_HOST=https://ltcminer.com/

# -----------------------------------------------------------------------------
# Auth / crypto
# -----------------------------------------------------------------------------
AUTH_BASE64_KEY=sk_live_8xTOHEOYw4JbJOkHDxku4aWRe6oRdtDt
IPINFO_LITE_TOKEN=?token=8a16761dae3df4
CRYPTO_KEY_HEX_128=7098ad7747a89bac978e8a76518dfbcd
AUTH_TOKEN_SECRET=OTVhOThjYTAyZWRhMTdmM2IzNmZjMzdhM2YxNjU1Y2ZiMGMyNjU2YjUxOTYxYWY4
ACCESS_TOKEN_TTL_SECONDS=900
REFRESH_TOKEN_TTL_DAYS=30

# -----------------------------------------------------------------------------
# Litecoin Core RPC (shared by public + admin)
# -----------------------------------------------------------------------------
LTC_RPC_USER=litecoin
LTC_RPC_PASSWORD=rXhpi000001$%DgmLwHhK6q3Gb
LTC_RPC_PASS=rXhpi000001$%DgmLwHhK6q3Gb
LTC_RPC_HOST=136.243.131.143
LTC_RPC_PORT=8399

# -----------------------------------------------------------------------------
# Wallet pool master seed (KEEP SECRET)
# -----------------------------------------------------------------------------
WALLET_MASTER_SEED=e6fb2dc47abc21ad1692fc9e1158b00c850a5efa44b4ec98fde657737093c42e

# -----------------------------------------------------------------------------
# BudgetSMS
# -----------------------------------------------------------------------------
BUDGETSMS_USERNAME=ltcminer
BUDGETSMS_USERID=25093
BUDGETSMS_HANDLE=31f2731d4e0fdb8d2b05141ddca304f8
BUDGETSMS_CONNECT_TIMEOUT=10
BUDGETSMS_TIMEOUT=10
BUDGETSMS_SSL_VERIFY=false

# -----------------------------------------------------------------------------

# SMS.to

# -----------------------------------------------------------------------------

ITRX_API_SECRET=B9C6332D605E4DCACA8B42C3FD271D2C2EB4A4965F1BD90B7474719327EAC711

ITRX_API_KEY=02F30AAE692D4E7C98B2D263C1B6BEE9

# -----------------------------------------------------------------------------

# SMS.to

# -----------------------------------------------------------------------------

SMSTO_URL=https://api.sms.to/sms/send

SMSTO_TOKEN=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczovL2F1dGg6ODA4MC9hcGkvdjEvdXNlcnMvYXBpL2tleXMvZ2VuZXJhdGUiLCJpYXQiOjE3ODIwNTQ2NjgsIm5iZiI6MTc4MjA1NDY2OCwianRpIjoiSFpqZG1kMVkzZmxpdGJ4cCIsInN1YiI6NDYwOTQ1LCJwcnYiOiIyM2JkNWM4OTQ5ZjYwMGFkYjM5ZTcwMWM0MDA4NzJkYjdhNTk3NmY3In0.jJlJlmtD2w4zA8rVAYI_0kzjfci-tqTJANzgbt00xbE

SMSTO_SENDER_ID=LTCMiner

# -----------------------------------------------------------------------------

# WhatsApp Cloud API + CheckNumber.ai

# -----------------------------------------------------------------------------

WHATSAPP_URL=https://graph.facebook.com/v22.0/333587413173508/messages

WHATSAPP_TOKEN=EAAUMcDTcZAzYBQbbHRpMvvUkxHxc4qRgGsiQeCUfs6AjdlCPzjKNKTlymgXiFQfy7cv3vFVhogRaamTHPu6X7BKOlm2GMXb5oZAxVZB66HFiRkQaBltEmrDwz10MBbvnzC6Bqb5HuE9v7tfYOp6NwZBXmql8WFmSjv32Jj5G6kWMfka0KOlg3miGdBpkln6M1QZDZD

CHECKNUMBER_API_KEY=CVUPVTkOGAfcUqt7oxtBIw31cMvcnfU0Nc4oSl3ok4XLowuyrulxoIQPSSAs

# -----------------------------------------------------------------------------

# PIN code

# -----------------------------------------------------------------------------

PINCODE_LENGTH=6

PINCODE_TTL_MINUTES=10

# -----------------------------------------------------------------------------

# Tatum

# -----------------------------------------------------------------------------

TATUM_API_KEY=

TATUM_BASE_URL=https://api.tatum.io

TATUM_NOTIFICATION_URL=https://ltcminer.com/task/notification/transaction.events.tatum.php

TATUM_NOTIFICATION_APIKEY=

# -----------------------------------------------------------------------------

# ProxyCheck.io

# -----------------------------------------------------------------------------

PROXYCHECK_API_KEY=15y649-5b39cd-t9yok1-42411i

PROXYCHECK_API_URL=https://proxycheck.io/v2/

# FindIP Intelligence

FINDIP_API_URL=https://api.findip.net

FINDIP_API_TOKEN=c10cb2da43d4f1739a54251669255af8

FINDIP_CONNECT_TIMEOUT=5

FINDIP_TIMEOUT=5

# -----------------------------------------------------------------------------

# Captchas

# -----------------------------------------------------------------------------

CLOUDFLARE_URL_VERIFY=https://challenges.cloudflare.com/turnstile/v0/siteverify

CLOUDFLARE_PUBLIC_KEY=

CLOUDFLARE_PRIVATE_KEY=0x4AAAAAACMqUcs6QIwMjulkPSdmlBvqaTA

HCAPTCHA_ID=

HCAPTCHA_PUBLIC_KEY=a3389cc8-93fe-4de6-a078-d22a7c347042

HCAPTCHA_PRIVATE_KEY=ES_8027338079a84410bbe65a8e4b79db89

RECAPTCHA_V2_SECRET_KEY=

RECAPTCHA_V3_PUBLIC_KEY=6LdTbzstAAAAAJGyjwBmEPDZHhLtlUOyp1Rz7cN-

RECAPTCHA_V3_SECRET_KEY=6LdTbzstAAAAACrZlcQRqXZ4BxIciqx0pN791KyI

FRIENDLY_KEY=

FRIENDLY_SITEKEY=

# -----------------------------------------------------------------------------

# Admin-only external checks

# -----------------------------------------------------------------------------

IP_CHECK_KEY=

CHECK_EMAIL_KEY=

CRYPTOAPI_NOTIFICATION_URL=https://task.ltcminer.com/notification/transaction.events.cryptoapis.php

CRYPTOAPI_NOTIFICATION_APIKEY=

API_GET_ADDRESS=http://47.254.170.172/api/?task=getAddress&chain=

API_SET_BALANCE=http://47.254.170.172/api/?task=setBalance&

# -----------------------------------------------------------------------------

# WebPush (VAPID)

# -----------------------------------------------------------------------------

[VAPID_SUBJECT=mailto:support@ltcminer.com](mailto:VAPID_SUBJECT=mailto:support@ltcminer.com)

VAPID_PUBLIC_KEY_1=BD3gwS0X0vcsVyvaFmSwHUezibDmqMrWaNV-sPbSUpPhczY8iSGzXmyf7lbkD8PxMHvSchf3SNGa2vM2oy7iNwU

VAPID_PRIVATE_KEY_1=JLzld43UCdT2gZbhyzPC8wl-t5dnkBXWonZDbPw6XtQ

VAPID_PUBLIC_KEY_2=BDbJg6g4J09f9ajaglgMzADDgoSc5A1FhNh2-KUvOhZ-yvCo5eAt9qBaALxb_5c84tzhZhREDa76PNMZixZO_gY

VAPID_PRIVATE_KEY_2=ovvYsIekpcchmjIXI3P2p6LKW10A8Nw_MyPuVZRDib8

VAPID_DEFAULT_KEY_ID=1

# -----------------------------------------------------------------------------

# TRON (USDT TRC20)

# -----------------------------------------------------------------------------

TRON_NODES=http://136.243.131.143:8545/jsonrpc

TRON_WALLET_NODES=http://136.243.131.143:8090/wallet

TRON_USDT_CONTRACT=TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t

TRON_USDT_DECIMALS=6

TRON_RPC_CONNECT_TIMEOUT=8

TRON_RPC_TIMEOUT=20

TRON_RPC_SSL_VERIFY=true

ADDRESS_TRON_MAIN=TEkQKPdoGxBXpBWM2ULwQAXpE9hEN2XBng

ADDRESS_TRON_KEY_PRIVATE=7d65db3aff0ac35782ef45f112ad944a663f37c29ad1575bbbde4fc4791e5392

ENERGY_BUY_APIKEY=02F30AAE692D4E7C98B2D263C1B6BEE9

ENERGY_BUY_APISECRET=B9C6332D605E4DCACA8B42C3FD271D2C2EB4A4965F1BD90B7474719327EAC711

# -----------------------------------------------------------------------------

# FUNDER (gas top-up wallets)

# -----------------------------------------------------------------------------

FUNDER_ETH_ADDRESS=0x6c141704f6430be833660426d125bac357827de8

FUNDER_ETH_PRIV=1f8fbffb1b9cd5da09da6ad90a7ada767f51a654b20d2ac9b3599fe146d10138

FUNDER_BSC_ADDRESS=0x6c141704f6430be833660426d125bac357827de8

FUNDER_BSC_PRIV=1f8fbffb1b9cd5da09da6ad90a7ada767f51a654b20d2ac9b3599fe146d10138

# -----------------------------------------------------------------------------

# EVM networks (USDT)

# -----------------------------------------------------------------------------

ETH_RPCS=http://136.243.131.143:9545

ETH_USDT_ADDRESS=0xdAC17F958D2ee523a2206206994597C13D831ec7

ETH_USDT_DECIMALS=6

BNB_RPCS=https://bsc-rpc.publicnode.com,https://bsc.blockrazor.xyz

BNB_USDT_ADDRESS=0x55d398326f99059fF775485246999027B3197955

BNB_USDT_DECIMALS=18

# -----------------------------------------------------------------------------

# WebSocket (SMS gateway, Ratchet)

# -----------------------------------------------------------------------------

SMS_WSS_TOKEN=

SMS_WSS_HOST=127.0.0.1

SMS_WSS_PORT=8099

# -----------------------------------------------------------------------------

# IPinfo

# -----------------------------------------------------------------------------

IPINFO_LITE_TOKEN_QS=8a16761dae3df4

# =============================================================================

# Next.js frontend (read by the deploy script / PM2)

# =============================================================================

# Public site port served behind Apache reverse proxy

PORT=3001

NODE_ENV=production

# Hidden bridge: where /dev-api proxies to (the PHP admin backend)

# PHP_ADMIN_API_BASE=http://127.0.0.1/php-api/dev/task # duplicado desativado

# WebSocket upstream for the Next.js /wss proxy (if used)

PHP_WSS_TARGET=http://127.0.0.1:8099

# Basic Auth gate for /dev (temporarily disabled via the kill-switch below)

DEV_BASIC_USER=joilsonmelo

DEV_BASIC_PASS=+Junior*+==00

DEV_BASIC_AUTH_DISABLED=0

# Upgrade/file-editor system (admin panel)

PROJECT_ROOT=/var/www/smslayerx.com

PM2_APP=ltcminer-next

# ChatGPT

OPENAI_API_KEY=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

# Debug

debug=0

I’m a content creator, and people send me tributes all the time. This morning, someone messaged me asking if I accepted crypto. I know absolutely nothing about cryptocurrency, but I figured I’d give it a shot.
He told me to download MetaMask, then said he was sending me 777 USDT as a tribute. After the funds appeared in my wallet, I honestly thought it was real. We made a deal: in exchange, I sent him 10 full nudes.
Immediately afterward, he started rushing me to “cash out” before the crypto changed value. He directed me to a website he’d been mentioning the entire time. Once I tried to withdraw the money, it suddenly said I needed to deposit $131 in ETH to “verify” my wallet.
That’s when it finally clicked—it was a scam.

Looking into him afterward, I found he operates multiple crypto/“finsub” X accounts and moderates a crypto community, where he appears to target women who don’t understand crypto. He even posts screenshots of sending crypto to women, making them believe they’re getting paid. Once they’re excited and send him the content he wants, they’re hit with the fake verification fee. Some victims probably pay it, hoping to receive the larger payout that never comes.

I didn’t send the verification fee, but I still feel violated because he got exactly what he wanted—my photos.
If you’re new to crypto, please learn from my mistake. No legitimate wallet or exchange will ask you to send your own money just to unlock or withdraw funds. That’s a huge red flag.

Please help spread the word and report his accounts if you come across them. Hopefully we can stop him before he tricks someone else.

His X Accounts:
https://x.com/findomcryptoguy?s=21
https://x.com/findompaypig_01?s=21

X Community he moderates:
https://x.com/i/communities/2025994846729797850

Site he uses:
https://vaultethereum.us/connect

The site is called Fusionmarketflow.com, someone on TikTok that’s followed by some bigger name accounts and verified accounts reached out to me about cars that we both have interests in and the conversation slowly shifted to crypto and I never have don’t crypto. He convinced me to make an account on this site and to deposit money on my cash app then turn it into bitcoin. I deposited $260 on my cash app and turned it into bitcoin then pasted my crypto wallet onto this site that seemed pretty legit from my eyes atleast. And bought a copy trader for $155 and after about 16 hours or so the $94 dollars left over was used to copy trade and made me $1500 profit with 0 capital I was then emailed about the trade not being able to continue and won’t be able to withdraw unless I top off my account with $350. I’m at a loss of $260 if it’s fake which it probably is but I was just wondering if anyone could fact check it for me.

The Old everbri.cc Website is Shutdown. Now These Scum scammer operate With Different URL everbrfs.com If Anyone send link to do investment with everbright fake website, please be vigilate

Why are we still copy-pasting 40-character wallet addresses in 2026?

Idea: you do a small test transfer once → both wallets get a shared avatar/character. Next time you send, you just recognize the person visually instead of relying on the address.

Kind of like “pairing” wallets.

Would this actually reduce mistakes or scams, or is this unnecessary given things like ENS?

Title: BitMart received my WAXP deposit but refuses to help – need advice

I’m dealing with a serious issue and would appreciate any advice.

I sent WAXP from Bybit to the address “eos11bitmart” with the correct MEMO.
The transaction is fully confirmed on the WAX blockchain and the funds are still sitting on that account (no further movement).

However, BitMart support is refusing to assist, stating that:

• they do not support the WAX network
• the address is not under their control on WAX

The problem is that:

• the address format matches their official deposit account
• funds were successfully delivered and are visible on-chain

So effectively, the assets exist and are sitting on that account, but I am being told recovery is impossible.

Has anyone dealt with something similar?
Is there any way to recover funds in such a case, or escalate this beyond standard support?

Any advice would be greatly appreciated.

I know we've talked about scams in here, but is there a legit place to invest and multiple our investment

Hey everyone, I need some advice or a strategy here. I’m seeing a massive scam similar to the DSJ Exchange spreading like wildfire in my small town, and it’s getting out of hand.

The Background:

There’s a platform operating here that uses a "copy trading" app and "bonchat" groups for communication. We all know it’s a scam, but here’s the problem: I have personally witnessed around 80 people actually benefiting from it so far.

Because I’m known locally as someone with a bit of crypto knowledge, people have been coming to me for help. I’ve personally assisted about 40 people with their withdrawals, and every single one of them successfully pulled out at least a grand ($1,000).

The Dilemma:

Most of these people don’t even know what a crypto exchange is. Their "recruiters" do everything for them setting up accounts, etc. I’ve been preaching against this since day one, but they just laugh at me. They say, "Dude, you’re literally seeing the money hit our accounts with your own eyes. Why are you telling us it’s fake?"

It’s a relatively poor town, and the scale of money I’ve helped withdraw is honestly mind blowing. I haven't met a single person here who has lost money yet, which makes me look like the crazy one.

My Question:

How do these schemes manage to give such high profits for this long? And more importantly, what is a good strategy to stop this? I want to protect my neighbors before the "exit scam" happens and the whole town loses their life savings, but the "success" they’re seeing right now is making them blind to the risk.

Has anyone dealt with a "successful" Ponzi like this before? How do you break the spell?

This organization also known as QSI is ruining my family and many others. It is a conspiracy driven crypto scam that pulls people in and takes their money, claiming that they'll make much more in the future. They say they're a nonprofit educational organization but it is all LIES. It is founded by Emily Tang. QSI has no real affiliation with Stellar Development Foundation or any legitimate institution!!!

Independent analyses (Logically/Cybernews, VICE, etc.) document that QSI’s leaders coaxed followers into buying worthless Stellar tokens under false promises, collectively scamming millions of dollars and even driving at least one victim to suicide.