Item Duplication Incident - Revision history

Kins: /* The recovered economy: current state */

2026-06-30T03:43:13Z

The recovered economy: current state

← Older revision		Revision as of 03:43, 30 June 2026
Line 209:		Line 209:
	\| Largest Old Coin / Hunting Coin holding \|\| '''595 / 661''' - ordinary farmed amounts (the ring's 30,000-stacks are gone)		\| Largest Old Coin / Hunting Coin holding \|\| '''595 / 661''' - ordinary farmed amounts (the ring's 30,000-stacks are gone)
	\|-		\|-
	\| Largest Bloody Coin / Gold holding \|\| '''481 / 49'''		\| Largest Bloody Coin / Gold / Frozen Rose holding \|\| '''481 / 49 / 212'''
	\|-		\|-
	\| Total items on server \|\| '''~49 million''', overwhelmingly ordinary consumables, materials and gear		\| Total items on server \|\| '''~49 million''', overwhelmingly ordinary consumables, materials and gear

Kins: /* Timeline (reconstructed from the logs) */

2026-06-30T03:06:36Z

Timeline (reconstructed from the logs)

← Older revision		Revision as of 03:06, 30 June 2026
Line 269:		Line 269:
	\| June 27-29 \|\| Full investigation, permanent fix, and recovery		\| June 27-29 \|\| Full investigation, permanent fix, and recovery
	\|-		\|-
	\| ~~(TBA)~~ \|\| Server reopens once everything is ~~verified~~		\| June 30, 15:00 \|\| Server reopens once everything is ready
	\|}		\|}

Kins: /* Accounts involved (permanently banned) */

2026-06-30T02:13:02Z

Accounts involved (permanently banned)

← Older revision		Revision as of 02:13, 30 June 2026
Line 224:		Line 224:
	== Accounts involved (permanently banned) ==		== Accounts involved (permanently banned) ==

	All characters listed below belonged to the exploit ring and are '''permanently banned'''. In total this is '''16 master accounts, 80 game accounts, and 157 characters'''~~, run by the same group~~. They are listed grouped by master account:		All characters listed below belonged to the exploit ring and are '''permanently banned'''. In total this is '''16 master accounts, 80 game accounts, and 157 characters'''. They are listed grouped by master account:

	* Mentalist, Ziahra, dupe server, ugpro, ggss, ggss2, Dealer, AmnZia, gymbro		* Mentalist, Ziahra, dupe server, ugpro, ggss, ggss2, Dealer, AmnZia, gymbro
Line 242:		Line 242:
	* Pepa, Kyoze, Aoii, Aooi, CindyNero, PAQUITO THE RAT, PACO RAT, pikaxuraton		* Pepa, Kyoze, Aoii, Aooi, CindyNero, PAQUITO THE RAT, PACO RAT, pikaxuraton
	* FREESANCHO, FREESANCHO1		* FREESANCHO, FREESANCHO1

			More accounts linked to these have been banned - but these are the ring accounts linked directly to duping.

	== Timeline (reconstructed from the logs) ==		== Timeline (reconstructed from the logs) ==

Kins: /* Timeline (reconstructed from the logs) */

2026-06-30T01:32:22Z

Timeline (reconstructed from the logs)

← Older revision		Revision as of 01:32, 30 June 2026
Line 263:		Line 263:
	\| June 27, 17:38 \|\| '''Backup restore point''' - the state we are reverting the server to		\| June 27, 17:38 \|\| '''Backup restore point''' - the state we are reverting the server to
	\|-		\|-
	\| June 27, 20:21 \|\| ~~Exploit confirmed;~~ '''~~server~~ taken offline''' for emergency maintenance (last activity in the database)		\| June 27, 20:21 \|\| '''Server taken offline''' for emergency maintenance (last activity in the database)
	\|-		\|-
	\| June 27-29 \|\| Full investigation, permanent fix, and recovery		\| June 27-29 \|\| Full investigation, permanent fix, and recovery

Kins: /* What happened */

2026-06-30T01:23:46Z

What happened

← Older revision		Revision as of 01:23, 30 June 2026
Line 26:		Line 26:
	A group of accounts discovered this and exploited it. They:		A group of accounts discovered this and exploited it. They:

	* duplicated stackable goods (refine materials, ~~event~~ coins, consumables, boxes and more),		* duplicated stackable goods (refine materials, coins, consumables, boxes and more),
	* converted large amounts of duplicated goods into zeny by selling to NPCs,		* converted large amounts of duplicated goods into zeny by selling to NPCs,
	* and spread some of the proceeds into the wider economy by buying out player shops and trading/dropping items.		* and spread some of the proceeds into the wider economy by buying out player shops and trading/dropping items.

Kins: /* Summary */

2026-06-30T01:23:20Z

Summary

← Older revision		Revision as of 01:23, 30 June 2026
Line 11:		Line 11:
	* A small group of accounts abused a bug in the '''Master Storage''' system to duplicate items, then converted many of those items into zeny by selling them to NPCs and to player shops.		* A small group of accounts abused a bug in the '''Master Storage''' system to duplicate items, then converted many of those items into zeny by selling them to NPCs and to player shops.
	* The abuse was minor for most of its roughly '''six days''', then escalated into a large '''"finale"''' in the final hours - and that finale is '''almost entirely undone by the backup rollback''', so the bulk of the damage has been reversed from the rollback alone.		* The abuse was minor for most of its roughly '''six days''', then escalated into a large '''"finale"''' in the final hours - and that finale is '''almost entirely undone by the backup rollback''', so the bulk of the damage has been reversed from the rollback alone.
	* We '''closed the server'''to stop further damage and to preserve the evidence needed for a clean recovery.		* We '''closed the server''' to stop further damage and to preserve the evidence needed for a clean recovery.
	* The underlying bug has been '''identified and permanently fixed.'''		* The underlying bug has been '''identified and permanently fixed.'''
	* We are restoring the server from a '''backup taken shortly before closure''' and '''removing the duplicated items and ill-gotten gains''' from the accounts responsible.		* We are restoring the server from a '''backup taken shortly before closure''' and '''removing the duplicated items and ill-gotten gains''' from the accounts responsible.

Kins: /* Summary */

2026-06-30T01:22:58Z

Summary

← Older revision		Revision as of 01:22, 30 June 2026
Line 11:		Line 11:
	* A small group of accounts abused a bug in the '''Master Storage''' system to duplicate items, then converted many of those items into zeny by selling them to NPCs and to player shops.		* A small group of accounts abused a bug in the '''Master Storage''' system to duplicate items, then converted many of those items into zeny by selling them to NPCs and to player shops.
	* The abuse was minor for most of its roughly '''six days''', then escalated into a large '''"finale"''' in the final hours - and that finale is '''almost entirely undone by the backup rollback''', so the bulk of the damage has been reversed from the rollback alone.		* The abuse was minor for most of its roughly '''six days''', then escalated into a large '''"finale"''' in the final hours - and that finale is '''almost entirely undone by the backup rollback''', so the bulk of the damage has been reversed from the rollback alone.
	* We '''closed the server''' ~~as soon as the abuse was confirmed,~~ to stop further damage and to preserve the evidence needed for a clean recovery.		* We '''closed the server'''to stop further damage and to preserve the evidence needed for a clean recovery.
	* The underlying bug has been '''identified and permanently fixed.'''		* The underlying bug has been '''identified and permanently fixed.'''
	* We are restoring the server from a '''backup taken shortly before closure''' and '''removing the duplicated items and ill-gotten gains''' from the accounts responsible.		* We are restoring the server from a '''backup taken shortly before closure''' and '''removing the duplicated items and ill-gotten gains''' from the accounts responsible.

Kins: /* What happened */

2026-06-30T01:21:27Z

What happened

← Older revision		Revision as of 01:21, 30 June 2026
Line 22:		Line 22:
	The Master Storage system is shared across all of the characters and accounts that belong to a single master account. Because of a '''timing flaw''', it was possible - '''only while the server was under heavy load''' - for the same stored items to be loaded and withdrawn more than once, creating duplicates.		The Master Storage system is shared across all of the characters and accounts that belong to a single master account. Because of a '''timing flaw''', it was possible - '''only while the server was under heavy load''' - for the same stored items to be loaded and withdrawn more than once, creating duplicates.

	In plain terms: server lag opened a brief window where two characters on the same master account could each open the same master storage, "take" the same items, and the game saved both copies. Repeating this allowed items to be multiplied.		In plain terms: server lag opened a brief window where two characters on the same master account could each open the same master storage, take the same items, and the game saved both copies. Repeating this allowed items to be multiplied.

	A group of accounts discovered this and exploited it. They:		A group of accounts discovered this and exploited it. They:

Kins: /* Summary */

2026-06-30T01:20:42Z

Summary

← Older revision		Revision as of 01:20, 30 June 2026
Line 10:		Line 10:

	* A small group of accounts abused a bug in the '''Master Storage''' system to duplicate items, then converted many of those items into zeny by selling them to NPCs and to player shops.		* A small group of accounts abused a bug in the '''Master Storage''' system to duplicate items, then converted many of those items into zeny by selling them to NPCs and to player shops.
	* The abuse was minor for most of its roughly '''six days''', then escalated into a large '''"finale"''' in the final hours - and that finale is '''almost entirely undone by the backup rollback''', so the bulk of the damage has been reversed.		* The abuse was minor for most of its roughly '''six days''', then escalated into a large '''"finale"''' in the final hours - and that finale is '''almost entirely undone by the backup rollback''', so the bulk of the damage has been reversed from the rollback alone.
	* We '''closed the server''' as soon as the abuse was confirmed, to stop further damage and to preserve the evidence needed for a clean recovery.		* We '''closed the server''' as soon as the abuse was confirmed, to stop further damage and to preserve the evidence needed for a clean recovery.
	* The underlying bug has been '''identified and permanently fixed.'''		* The underlying bug has been '''identified and permanently fixed.'''

Kins: Created page with "= Item Duplication Incident - Full Report and Resolution = '''Date:''' 2026-06-27, 20:21 server time
'''Status:''' Server temporarily closed after an item duplication exploit - investigation and cleanup complete; final verification underway ahead of reopening.
''Last updated: June 29, 2026'' This report explains the item duplication ("dupe") exploit that led us to take the server offline, what we found, how we fixed it, and exactly what we are doing to restore..."

2026-06-30T01:19:37Z

Created page with "= Item Duplication Incident - Full Report and Resolution = '''Date:''' 2026-06-27, 20:21 server time '''Status:''' Server temporarily closed after an item duplication exploit - investigation and cleanup complete; final verification underway ahead of reopening. ''Last updated: June 29, 2026'' This report explains the item duplication ("dupe") exploit that led us to take the server offline, what we found, how we fixed it, and exactly what we are doing to restore..."

New page

= Item Duplication Incident - Full Report and Resolution =

'''Date:''' 2026-06-27, 20:21 server time 
'''Status:''' Server temporarily closed after an item duplication exploit - investigation and cleanup complete; final verification underway ahead of reopening. 
''Last updated: June 29, 2026''

This report explains the item duplication ("dupe") exploit that led us to take the server offline, what we found, how we fixed it, and exactly what we are doing to restore the integrity of the economy. We have tried to be as transparent as possible.

== Summary ==

* A small group of accounts abused a bug in the '''Master Storage''' system to duplicate items, then converted many of those items into zeny by selling them to NPCs and to player shops.
* The abuse was minor for most of its roughly '''six days''', then escalated into a large '''"finale"''' in the final hours - and that finale is '''almost entirely undone by the backup rollback''', so the bulk of the damage has been reversed.
* We '''closed the server''' as soon as the abuse was confirmed, to stop further damage and to preserve the evidence needed for a clean recovery.
* The underlying bug has been '''identified and permanently fixed.'''
* We are restoring the server from a '''backup taken shortly before closure''' and '''removing the duplicated items and ill-gotten gains''' from the accounts responsible.
* The accounts involved are '''permanently banned.'''

We know how damaging dupes are to a server's economy and to your trust. Thank you for your patience while we made sure the fix and the cleanup were done correctly rather than quickly.

== What happened ==

The Master Storage system is shared across all of the characters and accounts that belong to a single master account. Because of a '''timing flaw''', it was possible - '''only while the server was under heavy load''' - for the same stored items to be loaded and withdrawn more than once, creating duplicates.

In plain terms: server lag opened a brief window where two characters on the same master account could each open the same master storage, "take" the same items, and the game saved both copies. Repeating this allowed items to be multiplied.

A group of accounts discovered this and exploited it. They:

* duplicated stackable goods (refine materials, event coins, consumables, boxes and more),
* converted large amounts of duplicated goods into zeny by selling to NPCs,
* and spread some of the proceeds into the wider economy by buying out player shops and trading/dropping items.

== Scope of the abuse ==

Our investigation reconstructed the activity from the server's transaction logs and the final database. At a high level:

* The exploit was driven by a '''single ring of 16 master accounts''', which have been fully identified.
* '''Millions''' of duplicated items were produced across many item types.
* A '''large amount of zeny''' was created out of thin air by NPC-selling duplicated goods, and a portion of it was laundered into the economy through player shops.
* The most intense activity - a final "burst" of NPC selling, shop buy-outs, and item drops in town - happened in the '''last few hours before we closed the server.'''

'''The overwhelming majority of the duplicated wealth stayed within the ring's own accounts''', which makes the bulk of it straightforward to remove. For a sense of scale: '''outside the banned ring and staff accounts, no single account holds more than about 1.5% of the total economy''' - and most hold far less. The exploit did not turn any ordinary player into a billionaire.

== The fix ==

* '''Immediate hotfix:''' Master Storage was disabled the moment the exploit was confirmed, so no further duplication was possible.
* '''Permanent fix:''' This was '''not''' a simple "forgot to check" mistake - a guard against opening the same storage twice was '''already in place.''' The real flaw was a '''race condition across our server processes.''' Master Storage is owned by a separate authoritative process (the character server) and loaded '''asynchronously''' by the map server each time a storage is opened. Under heavy load, that cross-process load could lag long enough for two characters on the same account to '''both clear the guard before either load finished''' - producing two independent in-memory copies of the same storage that were then each saved. We re-engineered how shared storage is acquired and reconciled so access is now '''serialized and validated across that asynchronous server boundary''', closing the window completely '''regardless of server load or latency.'''
* '''Better logging:''' We enabled additional item and storage logging so that any future anomaly can be detected and traced far more quickly.
* '''Infrastructure:''' Because the exploit depended on the lag that widened the timing window, we have '''migrated the server to a new, much more powerful host.''' It is faster and more stable, which removes the lag conditions the exploit relied on - a complement to the code fix, not a substitute for it.

== Our decision: restore from backup + remove ill-gotten assets ==

We weighed three options:

* '''(A) Full server wipe''' - a complete fresh start (characters, levels, and all progress reset).
* '''(B) Partial wipe''' - keep all characters and levels, but remove every item and all zeny server-wide.
* '''(C) Restore from a recent backup + surgically remove the duplicated assets''' from the accounts responsible.

We chose '''option C''', because it removes the damage while being the '''least punishing to innocent players.''' Both wipe options would have stripped honest players of items and wealth they legitimately earned (option A even more so, by erasing their characters entirely) - to clean up an exploit they had no part in. Restoring to just before the worst of the abuse, then surgically removing the duplicated assets, lets us undo the bulk of the damage while leaving honest players' progress and possessions intact.

'''Backup used:''' the most recent image available before closure, restored to the server's state as of '''17:38 server time on Saturday, June 27''' - approximately '''2 hours and 43 minutes before the server's last activity''' (the final transaction in the database is at 20:21 server time on June 27). The worst of the abuse (the final NPC-selling and shop buy-out "burst") happened in those final hours, so restoring to just before it '''reverses a large share of the laundering and dispersed items while costing only a few hours of normal progress''' rather than any more. In fact, '''about 84% of June 27's large NPC cash-outs happened after the 17:38 backup point''' - so the restore undoes the great majority of the finale.

On top of the restore, we are '''removing the duplicated items and the ill-gotten zeny''' that remain on the accounts responsible, and removing the small number of clearly-duplicated items that had been pushed onto a few outside accounts.

== What this means for you ==

* '''The final ~2 hours and 43 minutes of progress will be rolled back.''' Anything that happened after '''17:38 server time on June 27''' (levels, drops, trades, zeny, NPC purchases) will not carry over. We're sorry for this - it is the cost of undoing the worst of the abuse cleanly.
* '''Items you legitimately owned before that point are safe.'''
* '''If you sold items in your shop to one of the abusing accounts in those final hours''', that sale (and the zeny from it) is part of what gets rolled back.
* '''The accounts responsible are permanently banned''', and their holdings are being wiped as part of the cleanup.
* '''A small one-time zeny adjustment (about 10%) applies evenly to everyone''' - the final step that returns the economy to its proper level. Your '''items are untouched''', and because it's the same percentage for everybody, your '''standing relative to other players doesn't change.'''

== By the numbers ==

What we found, and how much the restore + clawback removed. '''Please read this clarification first:''' for items, the "On server at closure" figure below is the '''total number of units of the affected item ''types'' across the entire server - not a count of duplicates'''. The duplicated copies were overwhelmingly concentrated in the ring's own accounts, which is why nearly all of each type was removed.

{| class="wikitable"
|-
! Category !! On server at closure !! Removed
|-
| Affected item ''types'' - all copies (legit + duped) || ~1,866,000 units || '''~1,599,000 removed (about 86%)'''
|-
| Duplicated cards (ring-held) || 6,719 || '''6,719 (all of them)'''
|-
| Duplicated / laundered zeny || Created out of thin air by NPC-selling duped goods || '''100% removed''' (restore + clawback, with the small remainder offset by a one-time equalizing adjustment)
|}

Figures are rounded. The '''affected item types''' are the categories the ring duplicated - refine materials, event coins, consumables, boxes and similar. The ~14% of units '''not''' removed are '''not''' leftover duplicates - they are legitimately-owned copies (normal farmed coins, single legit items) plus a small amount that reached players through ordinary trade before the backup. We removed essentially all of the ring's duplicated copies; what remains is overwhelmingly honest player property.

== Affected item types: item-by-item ==

We swept the '''entire item database''' - every item, every card, and every piece of equipment in the game - looking for signs of duplication. The vast majority came back '''clean''' (normal player holdings); the table below is '''every item type that actually turned up duplicated in quantity'''.

For each affected type: '''On server at closure''' is the total amount of that item type in the database when the server shut down (legitimate copies included - '''not''' a count of duplicates); '''Removed''' is the duplicated / ring-hoarded copies deleted by the backup restore + clawback; '''Legitimate''' is what stays in the game afterward - ordinary player holdings, '''not''' duplicates.

{| class="wikitable sortable"
|-
! Item !! On server at closure !! Removed !! Legitimate (still in game) !! % removed
|-
| Revenant Costume Box 1 || 76 || 76 || 0 || 100.0%
|-
| Thick Battle Manual || 77,989 || 77,987 || 2 || 100.0%
|-
| HD Elunium || 106,474 || 106,340 || 134 || 99.9%
|-
| Old Card Album || 12,178 || 12,170 || 8 || 99.9%
|-
| HD Oridecon || 132,624 || 132,380 || 244 || 99.8%
|-
| Four Leaf Clover || 32,120 || 31,156 || 964 || 97.0%
|-
| Bloody Coin || 168,622 || 162,586 || 6,036 || 96.4%
|-
| 100 Cash Point Bag || 89,118 || 85,797 || 3,321 || 96.3%
|-
| Poison Bottle || 10,097 || 9,572 || 525 || 94.8%
|-
| Frozen Rose || 55,152 || 47,875 || 7,277 || 86.8%
|-
| Witherless Rose || 3,467 || 2,986 || 481 || 86.1%
|-
| Abysmal Knight Card || 161 || 138 || 23 || 85.7%
|-
| Gold || 4,394 || 3,653 || 741 || 83.1%
|-
| Old Coin || 618,448 || 496,984 || 121,464 || 80.4%
|-
| Hunting Coin || 555,456 || 429,431 || 126,025 || 77.3%
|-
| Sheen Aura Box || 12 || 9 || 3 || 75.0%
|-
| Valkyrie Helm Box || 10 || 7 || 3 || 70.0%
|-
| '''Total''' || '''1,866,398''' || '''1,599,147''' || '''267,251''' || '''85.7%'''
|}

The '''Legitimate''' column is ordinary player property. For example, the ~121,000 Old Coins still in the game are normal farmed currency spread across thousands of players (no one holds more than a few hundred) - '''not''' 121,000 duplicates. The ring's duplicated coins were hoarded on its own accounts and have all been deleted. Likewise the leftover Abysmal Knight Cards are legitimate single copies (largest holding is 3). '''Every duplicated item, and every valuable card, held by the ring was removed in full.'''

== What is recovered ==

{| class="wikitable"
|-
! Category !! Outcome
|-
| Duplicated items still held by the ring || '''Removed in full''' (their accounts are wiped)
|-
| Zeny created by the ring via NPC selling || '''Fully removed'''
|-
| The final-hours laundering into player shops || '''Largely reversed''' by restoring the pre-burst backup
|-
| Duplicated items pushed onto a few outside accounts || '''Removed''' where clearly identifiable
|-
| Cosmetics created in the final burst || '''Reversed''' by the backup
|}

== Restoring the economy to its proper level ==

The duplicated zeny was removed in two steps:

* '''Step 1 - wiping the ring's own accounts removed 89.6% of it.''' The overwhelming bulk of the duplicated zeny sat on the offenders' accounts (caught by the backup restore + the clawback) and was taken straight from them.
* '''Step 2 - a small, one-time, evenly-applied ~10.4% adjustment to all zeny balances removed the final 10.4%.''' This step was only needed for the last sliver that had spread into the wider economy.

Together those two steps account for '''100% of the duplicated zeny''', returning the economy to its '''proper, pre-exploit level.'''

For added peace of mind, the economy also '''destroys zeny on its own''' every day - many everyday NPC services charge zeny that is then permanently removed from the game. Over the server's lifetime, players have already spent:

{| class="wikitable"
|-
! Service !! Zeny removed from the economy
|-
| Socket enchanting || ~1.15 billion
|-
| Beelzebub Wing quest || ~1.10 billion
|-
| Warp service (warps + unlocks) || ~1.17 billion
|-
| Buff services || ~945 million
|-
| Hunter's Assurance || ~368 million
|-
| Lottery (after prize payouts) || ~36 million
|-
| Stat / skill resets || ~299 million
|-
| Kafra card, Soul Link, instances and more || ~320 million
|-
| '''Total tracked zeny sinks''' || '''~5.4 billion'''
|}

That is the equivalent of '''about half of the entire current economy''' drained back out through these sinks over the server's life - and it keeps happening every single day. So on top of the cleanup, the economy '''continuously self-corrects''': zeny is always being removed through normal play.

== The recovered economy: current state ==

For full closure, here is a snapshot of the actual database the server will reopen with, after the restore and the cleanup. The takeaway: '''everything looks normal.''' There are no giant stockpiles, no billionaires, and no leftover duplicate items.

{| class="wikitable"
|-
! Measure !! Current state
|-
| Total zeny in the economy || '''~9.4 billion''', spread across ~8,800 accounts
|-
| Wealthiest single account || '''~135 million''' - about '''1.4% of the economy''' (and most players hold far, far less)
|-
| Cloned/duplicate items remaining || '''Zero''' - every provably-duplicated item was removed
|-
| Largest stack of any single card || '''48''', and it's a common farming card; '''no valuable or MVP card is held in bulk'''
|-
| Most-held valuable card (Abysmal Knight) || largest single holding is just '''3''' (all legitimate)
|-
| Largest Old Coin / Hunting Coin holding || '''595 / 661''' - ordinary farmed amounts (the ring's 30,000-stacks are gone)
|-
| Largest Bloody Coin / Gold holding || '''481 / 49'''
|-
| Total items on server || '''~49 million''', overwhelmingly ordinary consumables, materials and gear
|}

In short, the recovered server looks '''healthy and ordinary''': wealth and rare items are spread thinly across the whole playerbase in normal amounts, the duplicated hoards are gone, and '''no single account dominates the economy.'''

== Consequences for those involved ==

The accounts that took part in the exploit have been '''permanently banned.''' Exploiting bugs to duplicate items is a serious violation of the rules, and we treat it as such.

If you '''unknowingly''' bought a duplicated item or received duped zeny through normal trade, '''you are not in trouble''' - some of those items/zeny may simply disappear as part of the cleanup, but no action will be taken against you.

== Accounts involved (permanently banned) ==

All characters listed below belonged to the exploit ring and are '''permanently banned'''. In total this is '''16 master accounts, 80 game accounts, and 157 characters''', run by the same group. They are listed grouped by master account:

* Mentalist, Ziahra, dupe server, ugpro, ggss, ggss2, Dealer, AmnZia, gymbro
* Eluveitie, Nightwish, HSBurn, ATRemains, HeavenSB, HPPS, Wintersun, Deathaura
* DollaBills, Mani, Pani, Teszz, Dollman, Faah, Haaf, Flaaa, Wzaas
* Daryl, Andrea, Sniper Daryl, Revenant Daryl, Merchant Daryl
* PACO MERMELIN, PACO MERMELIN2, jungle diff, YOU SURE EDDIE, PACO2, monkeyf
* Arcanna, Savage, Vulcana, Pancracio, Luthien, Verumoto, Tutty, Bellalith, Torcuato, Ghospelin Gonsales, Leire Diez, Papafrita, Xamp Jinping
* Kutxazain, Saltzailea, Sendatu, JulioIglesias, Irene Montero, PacoDeLucia, DuaLipa, Steel Crow
* Nicole Lee, Priscilla
* Ragmariz, Carapan, Pistolikas, Lianne, Boticaria, Divina, Hugo Champez
* Gerrardmino, Theopr, Yawgmoth, Solbad, Zerglink, Bragi Boy, Dancing Queen, Tessebik, Jihadi Jim, TheoWS, Weatherlight, Zergling, Hydralisk, Mutalisk, Guardian, Goliath, Dragoon, Karn, Golem Karn, Zealot Overlord, Zealot
* SirPeriox, Peirox, El Dopas, Endown, TunakTunak, DuaLupa
* 2222, 1111, whocares, some man, 1112, 1113, my hero, my new hero, 1115, 1116, Star Glad, Bragiman, 1117, 1118, 1119, 1110, sp song, mvp owner, Soul Linke, Holy Power
* iroh, toph, acua, akua, enue, ende, ametsa, kadun, vende, erosi, eroski, eroski0, Alea, merc, greed 1, greed 2, greed 3, greed 4, greed 5, greed 6, greed 7, greed 8, greed9, greed 10, greed 11, greed 12, greed 13, eroski1, Amets, next
* Kennen Smurf Account, K Kauppias, Abagagaga, Kahvipannu, Hapankorppu
* Pepa, Kyoze, Aoii, Aooi, CindyNero, PAQUITO THE RAT, PACO RAT, pikaxuraton
* FREESANCHO, FREESANCHO1

== Timeline (reconstructed from the logs) ==

All times are '''server time'''. This is what our investigation was able to reconstruct, including when each duplicated item type first showed up in large quantities.

{| class="wikitable"
|-
! When !! What we found
|-
| June 20-21 || Earliest exploit activity in the logs - unusually large NPC cash-outs begin (recurring ~11M sales, growing into the tens of millions)
|-
| June 22, 15:18 || First large duplicated stacks of refine materials - '''HD Oridecon / HD Elunium'''
|-
| June 26, evening || Mass consolidation: duplicated '''Old Coins''' and '''Hunting Coins''' moved in maximum 30,000 stacks; one account cashed out '''~1.84 billion zeny''' through NPC sales in under an hour
|-
| June 27, 00:11 || Large duplicated stacks of '''Cash Point Bags''' and '''Battle Manuals''' appear
|-
| June 27, 17:00-19:30 || '''The "finale"''' (peaking after 18:00): repeated massive NPC sales (individual sales up to '''~397 million zeny'''), '''Bloody Coins''' dumped, and items dropped in town
|-
| June 27, 17:38 || '''Backup restore point''' - the state we are reverting the server to
|-
| June 27, 20:21 || Exploit confirmed; '''server taken offline''' for emergency maintenance (last activity in the database)
|-
| June 27-29 || Full investigation, permanent fix, and recovery
|-
| (TBA) || Server reopens once everything is verified
|}

== Frequently asked questions ==

'''Will my legitimately-earned items be deleted?''' 
No. Only items duplicated by the exploit, the offenders' holdings, and clearly-identifiable duped items on a few outside accounts are removed. Normal holdings from before the backup point are safe.

'''Why is my zeny slightly lower than before?''' 
As the final step of the cleanup we applied a '''small one-time adjustment (about 10%)''' to everyone's zeny, so the server's total returns to its proper, pre-exploit level. Because it was applied '''equally to every player''', your ranking and your buying power relative to others are unchanged - and it's a far lighter touch than the full wipe we could have done. Your '''items were not affected.'''

'''Why did I lose the last few hours of progress?''' 
The worst of the abuse happened in those final hours. Restoring to just before it is the cleanest way to undo most of the laundering and dispersed items without a much larger rollback.

'''Why not just wipe the whole economy and start fresh?''' 
A full wipe punishes everyone equally - including the players who did nothing wrong. Our approach removes the abuse while preserving honest players' progress as much as possible.

'''Could this happen again?''' 
The specific bug has been permanently fixed, additional logging is in place to catch anomalies early, and we are improving performance so the lag conditions the exploit relied on are reduced.

'''What about duplicated costumes or wings?''' 
Costumes are '''purely cosmetic''' - no stats, no advantage. We removed every costume and costume box held by the banned accounts, and the rollback reverses most of what was scattered to others. A small number reached players before the backup; because opening a costume box creates a brand-new serial, those are '''impossible to tell apart''' from legitimately-earned ones, so we've left them rather than punish innocent players. They affect '''appearance only.'''

'''I think I have a duplicated item / I saw suspicious activity. What do I do?''' 
Please contact the staff team and we will deal with it immediately.

== Closing ==

We're sorry this happened. Dupe exploits strike at the heart of a server's economy, so we tried to do this as properly as we could: we traced the abuse through the server's transaction logs, identified accounts involved, swept the '''entire''' item database to be as certain as possible that nothing was missed, and rebuilt the underlying system so this class of bug cannot recur. Thank you for your patience and for sticking with us - we'll announce the reopening as soon as the final preparations are done.

''- The Revenant Elegy Team