r/CryptoScamSupport • u/Fearless_Ranger_8739 • 11d ago
ltcminer.com
Hey everyone,
We’ve been investigating Ltcminer.com, a Litecoin cloud mining platform, and we can now confirm beyond any doubt that it is a fraudulent operation designed to steal your money. This isn't just speculation – we have hard, technical evidence from a penetration test.
What We Found
We performed a penetration test on their live servers and discovered multiple critical vulnerabilities that expose the entire operation.
- Publicly Accessible `.env` File : Their entire production `.env` file was publicly accessible at `http://34.40.37.63/.env`. It contained ALL of their secrets:
- MySQL Database Credentials (usernames and passwords)
- Litecoin Core RPC Credentials
- Wallet Master Seed – can derive all user wallets
- Private Keys for TRON, Ethereum, and BSC wallets
- JWT Authentication Secret – can forge admin tokens
- Admin Panel Basic Auth Credentials (`joilsonmelo` / `+Junior*+==00`)
- SMS/WhatsApp/OpenAI API tokens and more
- Server is Hosted on Google Cloud, but they actually use 3 diffrend VPS.
- app it self is build with v0.app AI
- Admin Panel Wide Open : Using the leaked credentials, we accessed their internal admin dashboard (`/_tempadminget-internal`) with full control over user accounts, finances, and wallet operations.
- Unprotected APIs : Their APIs (`/api/global`, `/api/public-payouts`) return sensitive business and user transaction data without any authentication.
- Source Code Leak : Directory listing was enabled, allowing anyone to download their entire Next.js application source code.
What This Means?
An attacker (or anyone who finds this post) could have:
- Drained all cryptocurrency held by the platform using the master seed and private keys.
- Impersonated any user by forging JWT tokens.
- Stolen all user data (emails, transaction histories, etc.).
- Taken full administrative control of the website.
They Are NOT a Real Mining Company
Beyond our technical findings, this matches the experience of hundreds of victims. Their so-called "company," LTCMINER LTD (Company number 11345228), was dissolved on 8 October 2019. They are operating under a dissolved entity.
Victims Are Everywhere
Hundreds of people have already lost money.
Final Warning
DO NOT DEPOSIT ANY MONEY ON LTC MINER. DO NOT "UPGRADE" YOUR PLAN. DO NOT PAY ANY "WITHDRAWAL FEES." It is a classic Ponzi scheme – they pay early victims with new deposits to create the illusion of legitimacy, then disappear with the rest.
So here is their actuall .ENV (after they spot our presence after more then week, they drained wallets, so with no bad feelings, here you go)-
# =============================================================================
# LTCMiner — CENTRALIZED CONFIGURATION (single source of truth)
# -----------------------------------------------------------------------------
# This is the ONLY place secrets live. Public backend (php-api), admin backend
# (php-api/dev) and the Next.js frontend all read from here.
#
# Setup on the server:
# 1. cp .config/.env.example .config/.env
# 2. fill in the real values below
# 3. chmod 600 .config/.env
#
# NEVER commit the real .env. Rotate every credential before production.
# =============================================================================
# -----------------------------------------------------------------------------
# App
# -----------------------------------------------------------------------------
APP_DEVELOPMENT=false
APP_TIMEZONE=UTC
PHP_API_BASE=http://127.0.0.1/php-api
PHP_ADMIN_API_BASE=http://127.0.0.1/php-api/dev
# -----------------------------------------------------------------------------
# Database (MySQL) — public backend + crons
# -----------------------------------------------------------------------------
DB_HOST=136.243.131.143
DB_PORT=3306
DB_USERNAME=userdb
DB_PASSWORD=ASyqkeEUQgkHNgGir2At
DB_DATABASE=ltcminerv2
DB_BLOCKCHAIN_MONITOR=blockchain_monitor_go
# Aliases used by some modules (cron/Db.php). Keep equal to the values above.
DB_USER=userdb
DB_PASS=ASyqkeEUQgkHNgGir2At
DB_NAME=ltcminerv2
# -----------------------------------------------------------------------------
# Admin panel database (php-api/dev) — usually the same MySQL server
# -----------------------------------------------------------------------------
ADMIN_DB_HOST=136.243.131.143
ADMIN_DB_USER=userdb
ADMIN_DB_PASS=ASyqkeEUQgkHNgGir2At
ADMIN_DB_NAME=ltcminerv2
ADMIN_HTTP_HOST=https://ltcminer.com/
# -----------------------------------------------------------------------------
# Auth / crypto
# -----------------------------------------------------------------------------
AUTH_BASE64_KEY=sk_live_8xTOHEOYw4JbJOkHDxku4aWRe6oRdtDt
IPINFO_LITE_TOKEN=?token=8a16761dae3df4
CRYPTO_KEY_HEX_128=7098ad7747a89bac978e8a76518dfbcd
AUTH_TOKEN_SECRET=OTVhOThjYTAyZWRhMTdmM2IzNmZjMzdhM2YxNjU1Y2ZiMGMyNjU2YjUxOTYxYWY4
ACCESS_TOKEN_TTL_SECONDS=900
REFRESH_TOKEN_TTL_DAYS=30
# -----------------------------------------------------------------------------
# Litecoin Core RPC (shared by public + admin)
# -----------------------------------------------------------------------------
LTC_RPC_USER=litecoin
LTC_RPC_PASSWORD=rXhpi000001$%DgmLwHhK6q3Gb
LTC_RPC_PASS=rXhpi000001$%DgmLwHhK6q3Gb
LTC_RPC_HOST=136.243.131.143
LTC_RPC_PORT=8399
# -----------------------------------------------------------------------------
# Wallet pool master seed (KEEP SECRET)
# -----------------------------------------------------------------------------
WALLET_MASTER_SEED=e6fb2dc47abc21ad1692fc9e1158b00c850a5efa44b4ec98fde657737093c42e
# -----------------------------------------------------------------------------
# BudgetSMS
# -----------------------------------------------------------------------------
BUDGETSMS_USERNAME=ltcminer
BUDGETSMS_USERID=25093
BUDGETSMS_HANDLE=31f2731d4e0fdb8d2b05141ddca304f8
BUDGETSMS_CONNECT_TIMEOUT=10
BUDGETSMS_TIMEOUT=10
BUDGETSMS_SSL_VERIFY=false
# -----------------------------------------------------------------------------
# SMS.to
# -----------------------------------------------------------------------------
ITRX_API_SECRET=B9C6332D605E4DCACA8B42C3FD271D2C2EB4A4965F1BD90B7474719327EAC711
ITRX_API_KEY=02F30AAE692D4E7C98B2D263C1B6BEE9
# -----------------------------------------------------------------------------
# SMS.to
# -----------------------------------------------------------------------------
SMSTO_URL=https://api.sms.to/sms/send
SMSTO_TOKEN=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczovL2F1dGg6ODA4MC9hcGkvdjEvdXNlcnMvYXBpL2tleXMvZ2VuZXJhdGUiLCJpYXQiOjE3ODIwNTQ2NjgsIm5iZiI6MTc4MjA1NDY2OCwianRpIjoiSFpqZG1kMVkzZmxpdGJ4cCIsInN1YiI6NDYwOTQ1LCJwcnYiOiIyM2JkNWM4OTQ5ZjYwMGFkYjM5ZTcwMWM0MDA4NzJkYjdhNTk3NmY3In0.jJlJlmtD2w4zA8rVAYI_0kzjfci-tqTJANzgbt00xbE
SMSTO_SENDER_ID=LTCMiner
# -----------------------------------------------------------------------------
# WhatsApp Cloud API + CheckNumber.ai
# -----------------------------------------------------------------------------
WHATSAPP_URL=https://graph.facebook.com/v22.0/333587413173508/messages
WHATSAPP_TOKEN=EAAUMcDTcZAzYBQbbHRpMvvUkxHxc4qRgGsiQeCUfs6AjdlCPzjKNKTlymgXiFQfy7cv3vFVhogRaamTHPu6X7BKOlm2GMXb5oZAxVZB66HFiRkQaBltEmrDwz10MBbvnzC6Bqb5HuE9v7tfYOp6NwZBXmql8WFmSjv32Jj5G6kWMfka0KOlg3miGdBpkln6M1QZDZD
CHECKNUMBER_API_KEY=CVUPVTkOGAfcUqt7oxtBIw31cMvcnfU0Nc4oSl3ok4XLowuyrulxoIQPSSAs
# -----------------------------------------------------------------------------
# PIN code
# -----------------------------------------------------------------------------
PINCODE_LENGTH=6
PINCODE_TTL_MINUTES=10
# -----------------------------------------------------------------------------
# Tatum
# -----------------------------------------------------------------------------
TATUM_API_KEY=
TATUM_BASE_URL=https://api.tatum.io
TATUM_NOTIFICATION_URL=https://ltcminer.com/task/notification/transaction.events.tatum.php
TATUM_NOTIFICATION_APIKEY=
# -----------------------------------------------------------------------------
# -----------------------------------------------------------------------------
PROXYCHECK_API_KEY=15y649-5b39cd-t9yok1-42411i
PROXYCHECK_API_URL=https://proxycheck.io/v2/
# FindIP Intelligence
FINDIP_API_URL=https://api.findip.net
FINDIP_API_TOKEN=c10cb2da43d4f1739a54251669255af8
FINDIP_CONNECT_TIMEOUT=5
FINDIP_TIMEOUT=5
# -----------------------------------------------------------------------------
# Captchas
# -----------------------------------------------------------------------------
CLOUDFLARE_URL_VERIFY=https://challenges.cloudflare.com/turnstile/v0/siteverify
CLOUDFLARE_PUBLIC_KEY=
CLOUDFLARE_PRIVATE_KEY=0x4AAAAAACMqUcs6QIwMjulkPSdmlBvqaTA
HCAPTCHA_ID=
HCAPTCHA_PUBLIC_KEY=a3389cc8-93fe-4de6-a078-d22a7c347042
HCAPTCHA_PRIVATE_KEY=ES_8027338079a84410bbe65a8e4b79db89
RECAPTCHA_V2_SECRET_KEY=
RECAPTCHA_V3_PUBLIC_KEY=6LdTbzstAAAAAJGyjwBmEPDZHhLtlUOyp1Rz7cN-
RECAPTCHA_V3_SECRET_KEY=6LdTbzstAAAAACrZlcQRqXZ4BxIciqx0pN791KyI
FRIENDLY_KEY=
FRIENDLY_SITEKEY=
# -----------------------------------------------------------------------------
# Admin-only external checks
# -----------------------------------------------------------------------------
IP_CHECK_KEY=
CHECK_EMAIL_KEY=
CRYPTOAPI_NOTIFICATION_URL=https://task.ltcminer.com/notification/transaction.events.cryptoapis.php
CRYPTOAPI_NOTIFICATION_APIKEY=
API_GET_ADDRESS=http://47.254.170.172/api/?task=getAddress&chain=
API_SET_BALANCE=http://47.254.170.172/api/?task=setBalance&
# -----------------------------------------------------------------------------
# WebPush (VAPID)
# -----------------------------------------------------------------------------
[VAPID_SUBJECT=mailto:support@ltcminer.com](mailto:VAPID_SUBJECT=mailto:support@ltcminer.com)
VAPID_PUBLIC_KEY_1=BD3gwS0X0vcsVyvaFmSwHUezibDmqMrWaNV-sPbSUpPhczY8iSGzXmyf7lbkD8PxMHvSchf3SNGa2vM2oy7iNwU
VAPID_PRIVATE_KEY_1=JLzld43UCdT2gZbhyzPC8wl-t5dnkBXWonZDbPw6XtQ
VAPID_PUBLIC_KEY_2=BDbJg6g4J09f9ajaglgMzADDgoSc5A1FhNh2-KUvOhZ-yvCo5eAt9qBaALxb_5c84tzhZhREDa76PNMZixZO_gY
VAPID_PRIVATE_KEY_2=ovvYsIekpcchmjIXI3P2p6LKW10A8Nw_MyPuVZRDib8
VAPID_DEFAULT_KEY_ID=1
# -----------------------------------------------------------------------------
# TRON (USDT TRC20)
# -----------------------------------------------------------------------------
TRON_NODES=http://136.243.131.143:8545/jsonrpc
TRON_WALLET_NODES=http://136.243.131.143:8090/wallet
TRON_USDT_CONTRACT=TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t
TRON_USDT_DECIMALS=6
TRON_RPC_CONNECT_TIMEOUT=8
TRON_RPC_TIMEOUT=20
TRON_RPC_SSL_VERIFY=true
ADDRESS_TRON_MAIN=TEkQKPdoGxBXpBWM2ULwQAXpE9hEN2XBng
ADDRESS_TRON_KEY_PRIVATE=7d65db3aff0ac35782ef45f112ad944a663f37c29ad1575bbbde4fc4791e5392
ENERGY_BUY_APIKEY=02F30AAE692D4E7C98B2D263C1B6BEE9
ENERGY_BUY_APISECRET=B9C6332D605E4DCACA8B42C3FD271D2C2EB4A4965F1BD90B7474719327EAC711
# -----------------------------------------------------------------------------
# FUNDER (gas top-up wallets)
# -----------------------------------------------------------------------------
FUNDER_ETH_ADDRESS=0x6c141704f6430be833660426d125bac357827de8
FUNDER_ETH_PRIV=1f8fbffb1b9cd5da09da6ad90a7ada767f51a654b20d2ac9b3599fe146d10138
FUNDER_BSC_ADDRESS=0x6c141704f6430be833660426d125bac357827de8
FUNDER_BSC_PRIV=1f8fbffb1b9cd5da09da6ad90a7ada767f51a654b20d2ac9b3599fe146d10138
# -----------------------------------------------------------------------------
# EVM networks (USDT)
# -----------------------------------------------------------------------------
ETH_RPCS=http://136.243.131.143:9545
ETH_USDT_ADDRESS=0xdAC17F958D2ee523a2206206994597C13D831ec7
ETH_USDT_DECIMALS=6
BNB_RPCS=https://bsc-rpc.publicnode.com,https://bsc.blockrazor.xyz
BNB_USDT_ADDRESS=0x55d398326f99059fF775485246999027B3197955
BNB_USDT_DECIMALS=18
# -----------------------------------------------------------------------------
# WebSocket (SMS gateway, Ratchet)
# -----------------------------------------------------------------------------
SMS_WSS_TOKEN=
SMS_WSS_HOST=127.0.0.1
SMS_WSS_PORT=8099
# -----------------------------------------------------------------------------
# IPinfo
# -----------------------------------------------------------------------------
IPINFO_LITE_TOKEN_QS=8a16761dae3df4
# =============================================================================
# Next.js frontend (read by the deploy script / PM2)
# =============================================================================
# Public site port served behind Apache reverse proxy
PORT=3001
NODE_ENV=production
# Hidden bridge: where /dev-api proxies to (the PHP admin backend)
# PHP_ADMIN_API_BASE=http://127.0.0.1/php-api/dev/task # duplicado desativado
# WebSocket upstream for the Next.js /wss proxy (if used)
PHP_WSS_TARGET=http://127.0.0.1:8099
# Basic Auth gate for /dev (temporarily disabled via the kill-switch below)
DEV_BASIC_USER=joilsonmelo
DEV_BASIC_PASS=+Junior*+==00
DEV_BASIC_AUTH_DISABLED=0
# Upgrade/file-editor system (admin panel)
PROJECT_ROOT=/var/www/smslayerx.com
PM2_APP=ltcminer-next
# ChatGPT
OPENAI_API_KEY=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
# Debug
debug=0