Written by hand by Byte Bender · November 2026

We were hacked
& we are back hard!

Sep 1 · 7:30 AM

The hack

7:30 AMzZme, asleepour old serverLTC nodewallet keyŁŁŁŁŁŁ$300 LTCempty!BotsGatewaysrunningzZ!!#@$%!ow!#@$%!ow!root!hehestock out?

Our old server: LTC node, bots, gateways. And the wallet, right inside.

Sep 1 · evening

I woke up

project.tssafe$470zZ!!#@$%!ow!our serverwallet$0 LTCDB recordsŁŁŁΞ#@$%!ow!stock out?stock out??UTXO error!phewonly $30?!

Me: worked all night on a big project. Slept at 7 AM.

Sep 12

They turned our server into a DDoS machine

our serverour appCPU15%site Asite Bsite C#@$%!ow!DDoSzZ!!#@$%!ow!hahahacan't leave it like this!

Sep 12. They came back.

The rebuild

No wallets on the server

our serverBotAPIGatewaywallets: 0retiredmy homeno doorLISI

New arch. New setup.

Here's how it works,

How it works · 1

LISI's one job: check everything, then send

SMS box (separate)our SIMour serversGatewaywatchingBotAPILitecoin networkzZ!!#@$%!ow!your walletmy homeLISIrateTkTk 1,000 inSIGNEDŁany LTC to send?yes!bot signed?

You buy LTC: pay Tk with bKash or Nagad.

How it works · 2

/send: only your password can approve it

DISCORD/send 0.5 LTC ltc1q…7fConfirm in browsertc.bazarexchange.ltdSend0.5 LTCto ltc1q…7fWallet passwordApprove sendyour password stays hereBotAPIthey only carry itmy homeLISIltc1q…7fŁSent!any LTC to send?

/send gives you a Confirm in browser link.

And if they come back?

Hack it again? Still nothing.

our serversBotAPIGatewaymy homeLISIyou: …7f#@$%!ow!0.5 LTCto ltc1q…7fREFUSEDREFUSEDhe paid, trust me!signed SMS?no door?!no wallets?!

Say they hack the bot and the API again.

So if the bot, the API and the gateway get hacked again, they still can't move your coins. That takes your password, and only you have it.

Pre-launched today, things seem to be running fine!

Happy Exchanging again!

Byte Bender

Founder & Executive, Bazar Exchange

Read it in my words

Our server running the LTC node, Bots, Gateways was compromised.
Can't confirm the source, but the whole dedicated server's root was compromised.
Later the hacker team had swept every penny from our LTC node's wallet.

As I was busy in a large-scale project, I was working day & night. Just slept at 7 AM that morning. Evening I woke up, got reports of stock out. Ignored, bcz last night I just restocked and I didn't notice any big payments. Later more reports. Not a Stock Out error, a UTXO error! Unusual. I checked...

My whole wallet was gone... a clean sweep! A hack!

That server had more wallets, more money, but it was hidden under DB records and piles. I instantly withdrew all! It was safe.
Later they went through the DB records too.

I still was at the project, couldn't work on BZR... I left it as it was.

They started running DDoS attacks from my server. CPU spiked 100%, all red.
Can't leave it like this anymore!
The backup, new arch, new setup, reinstall.

Since then

All throughout this I had been planning how to make things safe, better, can't be stolen. Took me long enough, got a path.

  • Reworked the Payment Gateway
  • Reworked the Bot
  • Reworked the API that handles the blockchain
  • Made a whole new system for the system!

Here's how it works,

No LTC, no wallets live in the server anymore!
Now they have their own box, LISI (a dedicated PC with NO door), running at my home.

LISI has one job: ask the API, is there any LTC to send? Yes? Sending!
Bot, Gateway, API have no wallets. Hack them all, you will find nothing!

/send gives you a "Confirm in browser" link to our own page, tc.bazarexchange.ltd.

- shows the exact send.
- type your Wallet password.
- hit Approve.
- and it's Sent.

Password never leaves your browser, not even hashed. It's all signs and proofs, and it fits that one send only.
LISI checks it, reads the transaction itself, then signs.

Hack the bot again and swap the address? LISI sees it doesn't match what you approved. Refused. No password, no new proof.

Buys too. Your bKash/Nagad SMS lands on our SIM in a separate box, which signs it. LISI pays a buy only with that signed SMS. A hacked bot saying "he paid, trust me" gets nothing. LOL