Security & Platform History
Why BTCBUNCH was rebuilt from scratch. What happened to old accounts. And how we secure your earnings today.
If you're asking: "Why is the platform new?" "Where are my old account details?" "Why did I have to register again?" — This page answers everything.
The Beginning 2019–2021
BTCBUNCH launched in 2019 during the peak of the crypto faucet era. Back then, earning crypto online was simpler. The bot problem wasn't nearly as severe. AI didn't exist in the form we see today.
Like many platform owners, I purchased a paid script to run the site. It had all the basic features: faucet claims, PTC ads, referral systems, offerwalls. Everything worked fine — at first.
The problem with buying scripts: When you buy a script from a third-party developer, you're buying a black box. Code you didn't write. Logic you don't fully understand. Security measures you cannot verify.
The Invisible Enemy: Script Vulnerabilities
The original script I purchased had hidden security flaws. Here's what we discovered over time:
SQL Injection
Queries built with string concatenation. Attackers could extract entire user databases, modify token balances, or delete records.
Session Fixation
Weak session management allowed attackers to steal active user sessions and drain accounts.
Unvalidated Redirects
External links passed directly in URL parameters. Attackers could replace URLs with phishing sites.
Insecure File Uploads
Profile avatars allowed PHP file uploads. Attackers could upload shells and take over the server.
Here's an example of what the vulnerable code looked like:
// VULNERABLE - DO NOT USE
$query = "SELECT * FROM users WHERE id = " . $_GET['id'];
$result = mysqli_query($conn, $query);
With code like this, an attacker could submit ?id=1 OR 1=1 and retrieve EVERY user record — emails, password hashes, token balances.
The AI Problem 2022–2024
Then AI arrived. Suddenly, bots weren't just running simple scripts. They became:
- Smarter — solving simple math captchas instantly
- Faster — mimicking human behavior with realistic mouse movements
- Harder to detect — rotating IP addresses, random delays, session spoofing
A single attacker could run hundreds of automated accounts. Each account claimed faucet rewards, clicked PTC ads, completed surveys — all without a human present.
The result: Token inflation (too many tokens generated from fake activity) → Advertiser fraud (fake clicks on PTC campaigns) → Reward depletion (real users earned less because pools were drained by bots) → Server costs skyrocketed (handling fake traffic).
Revenue dropped. Server bills stayed high. The platform was bleeding money to automated attacks.
Why We Had to Start Over
After years of patching holes in someone else's code, fighting bots with limited tools, and losing money to automated fraud, I made a difficult decision: rebuild from scratch.
Not a migration. Not an upgrade. A complete rewrite.
This meant:
- Writing every line of code myself
- Implementing proper security from day one
- Building a database structure I fully understand
- Creating custom anti-bot measures
- Adding token-based URL masking (so referral links and ad URLs can't be stolen)
- Implementing Cloudflare Turnstile to block automated access
- Building multi-layered offense detection (speed hack penalties, cooldowns, tiered punishments)
Your old account data is gone. Not by accident. By design. Migrating old data would mean bringing over unverified user accounts (many were bots), inflated token balances (earned through exploits), corrupted session data, and insecure password hashes. It was safer to start fresh than to import years of compromised data.
What's Different This Time?
| Old Platform | New BTCBUNCH |
|---|
| Bought script (unknown security) | Custom-built, fully understood code |
| SQL injection vulnerabilities | All queries use prepared statements |
| Visible URLs in parameters | Token-based URL masking |
| Basic math captcha | Cloudflare Turnstile + math captcha layers |
| No session security | HttpOnly, Secure, SameSite cookies |
| No CSRF protection | Tokens on all state-changing actions |
| Error messages exposed | Error logging only, never displayed |
| No bot detection | Multi-tier offense detection + penalties |
| Weak referral link protection | Session-bound referral tokens |
| No rate limiting | Cooldowns and daily limits on all earning methods |
Security Measures Now Protecting Your Earnings
1. Prepared Statements Everywhere
Every database query uses parameterized statements. SQL injection is impossible.
// SECURE - This is how we write queries now
$stmt = $pdo->prepare("SELECT * FROM users WHERE id = ?");
$stmt->execute([$userId]);
2. Token-Based URL Masking
When you click a PTC ad, the real URL is never exposed. Only a temporary token appears in your browser. Even if someone steals the link, they can't claim your reward — the token is bound to your session.
// BEFORE (vulnerable):
/ptc-countdown.php?url=https://advertiser.com/offer
// AFTER (secure):
/ptc-countdown.php?token=abc123xyz
3. Multi-Layer Bot Detection
- Speed hack detection (tiered penalties for rapid claims)
- 24-hour cooldowns on repeatable tasks
- Session binding (tokens can't be shared across accounts)
- IP monitoring for suspicious patterns
4. Cloudflare Turnstile
No more frustrating "select all buses" puzzles. Turnstile works invisibly in the background, blocking bots without bothering real users.
5. Secure Session Management
- Session cookies are HttpOnly (JavaScript can't steal them)
- Secure flag enabled (cookies only sent over HTTPS)
- Session regeneration after login (prevents fixation)
- Strict timeout enforcement
6. CSRF Protection
Every form that changes data includes a unique token. Cross-site request forgery attacks won't work.
7. Rate Limiting
- Faucet claims: 30-minute cooldown
- PTC ads: 24-hour cooldown per ad
- Daily bonuses: one claim per day
- Jobs: manual approval prevents spam
8. Offense Tracking System
Repeated violations trigger progressively harsher penalties:
- Tier 1: Warning
- Tier 2: 1-hour cooldown
- Tier 3: 24-hour suspension
- Tier 4: Permanent ban
9. Server-Level Hardening
- SQL injection patterns blocked at .htaccess level
- Bad bot user agents blocked
- Sensitive folders (config, includes, vendor) protected
- Directory listing disabled
- PHP execution blocked in upload directories
A Final Note to Long-Time Users
If you were a legitimate user on the old platform, I see you. I appreciate you. And I'm genuinely sorry that rebuilding meant leaving your history behind.
But I hope you understand: running a platform where bots earn more than real people isn't sustainable. Starting fresh with proper security was the only way to ensure BTCBUNCH survives — and thrives — for years to come.
Your new account earns fairly. Your tokens are safe. And the platform is secure.
If you have questions, reach out through support. I'll answer honestly.
Want to verify our security claims?
— Check our .htaccess file (we show it publicly)
— Review our open-source security headers
— Test our token-based URL masking yourself
— Contact support for a technical deep dive