About the Recent Cubit Hack
SirKewberth
EdenForum Administrator, Forum Moderator, Game Developer
A number of players were banned yesterday for using an exploit in the game. The exploit itself was patched. If you're not interested in all the small details feel free to just read the summary at the end of this post.
We know when the exploit was used, because it's something we watch for and guard against. Unfortunately, while that check was in place, there was a way around it that was missed and discovered. It was not something you could do just by playing the game normally. It required using special cheat tools, so it's something that had to be looked for by people searching for ways to cheat. This isn’t a problem unique to Cubic Castles, of course… even the largest game companies are constantly patching their software against this sort of hacking.
The exploit created a very large amount of cubits, but the good news is that most of them could not be retrieved/spawned. Of the cubits they were able to spawn, a large amount were stored or hidden away, so those didn't affect the game directly. But many cubits still made their way into the economy. Some were sold to players offline, and some were used to buy items in the game. This is bad the game and honest players. It hurts sales, which in turn hurts the resources we have to update and improve the game. It raises prices of in-game items. And lastly, once players are banned, some of the items they bought are then removed from the game.
The number of cubits increases through regular play and sales. Every time someone spawns cubits they're added to the economy. If someone buys cubits they are also added to the economy. So this is always happening in most games with an in-game currency. Most games counteract this by providing ways for their in-game currency to also leave the economy, usually via purchases, but sometimes through taxing in-game sales. Adding many cubits from a hack abnormally increases the amount of cubits in the game. It doesn't affect official prices since those are fixed in the cubit store, but can affect player trades. Since most of the hacked cubits from this exploit weren't directly added to the game, the damage this caused is limited but still an issue.
Lastly, we've blocked logging in from many VPNs. VPNs are often used to bypass bans and to hide a player's identity, and while there are some legitimate reasons to use one, we felt that to limit cheating, hacking and ban evasion this was for the best solution for now. If you're an honest player who regularly plays by VPN for some reason, contact support and maybe we can help you.
Players who are banned:
- Exploiters
- Players who received large cubit tips with no reason from the exploiters. If you were banned for this but have a good reason (like selling a rare item) you can appeal to support via a ticket.
- Players who bought cubits from the exploiters
- Players who helped the exploiters. e.g. transferring cubits to and from, storing cubits etc...
Players who were not banned:
- Players who did legitimate trades for hacked cubits (There is no way for these players to know the cubits were illegitimate so they are not blamed.)
Players who were banned may try to cause more trouble, but we'll deal with them on a case by case basis going forward. If necessary we will contact authorities, as continuously attempting to harm the game is not acceptable and should be met with an appropriate response.
TLDR:
Some players found a hack, made a bunch of cubits, and got banned for it. They added a large amount of cubits to the game, but the damage was limited since much of what was hacked was only stored, hidden, or unable to be spawned. Since some rare items were removed from the game abnormally via the hack, we will look at which rares were bought and removed, and re-add them slowly to the game via contests or other means, like fishing prizes, above our normal yearly limits. We determined a rollback of the game was not the right approach in this case. We did our best to fix and clean up what we could, but have to live with the outcome.
We know when the exploit was used, because it's something we watch for and guard against. Unfortunately, while that check was in place, there was a way around it that was missed and discovered. It was not something you could do just by playing the game normally. It required using special cheat tools, so it's something that had to be looked for by people searching for ways to cheat. This isn’t a problem unique to Cubic Castles, of course… even the largest game companies are constantly patching their software against this sort of hacking.
The exploit created a very large amount of cubits, but the good news is that most of them could not be retrieved/spawned. Of the cubits they were able to spawn, a large amount were stored or hidden away, so those didn't affect the game directly. But many cubits still made their way into the economy. Some were sold to players offline, and some were used to buy items in the game. This is bad the game and honest players. It hurts sales, which in turn hurts the resources we have to update and improve the game. It raises prices of in-game items. And lastly, once players are banned, some of the items they bought are then removed from the game.
The number of cubits increases through regular play and sales. Every time someone spawns cubits they're added to the economy. If someone buys cubits they are also added to the economy. So this is always happening in most games with an in-game currency. Most games counteract this by providing ways for their in-game currency to also leave the economy, usually via purchases, but sometimes through taxing in-game sales. Adding many cubits from a hack abnormally increases the amount of cubits in the game. It doesn't affect official prices since those are fixed in the cubit store, but can affect player trades. Since most of the hacked cubits from this exploit weren't directly added to the game, the damage this caused is limited but still an issue.
Lastly, we've blocked logging in from many VPNs. VPNs are often used to bypass bans and to hide a player's identity, and while there are some legitimate reasons to use one, we felt that to limit cheating, hacking and ban evasion this was for the best solution for now. If you're an honest player who regularly plays by VPN for some reason, contact support and maybe we can help you.
Players who are banned:
- Exploiters
- Players who received large cubit tips with no reason from the exploiters. If you were banned for this but have a good reason (like selling a rare item) you can appeal to support via a ticket.
- Players who bought cubits from the exploiters
- Players who helped the exploiters. e.g. transferring cubits to and from, storing cubits etc...
Players who were not banned:
- Players who did legitimate trades for hacked cubits (There is no way for these players to know the cubits were illegitimate so they are not blamed.)
Players who were banned may try to cause more trouble, but we'll deal with them on a case by case basis going forward. If necessary we will contact authorities, as continuously attempting to harm the game is not acceptable and should be met with an appropriate response.
TLDR:
Some players found a hack, made a bunch of cubits, and got banned for it. They added a large amount of cubits to the game, but the damage was limited since much of what was hacked was only stored, hidden, or unable to be spawned. Since some rare items were removed from the game abnormally via the hack, we will look at which rares were bought and removed, and re-add them slowly to the game via contests or other means, like fishing prizes, above our normal yearly limits. We determined a rollback of the game was not the right approach in this case. We did our best to fix and clean up what we could, but have to live with the outcome.