DEV Community: 이해민

BreachLab: I Reproduce Real Crypto Hacks as Safe, Free Code

이해민 — Sat, 03 Oct 2026 17:52:27 +0000

Why

The Bitget hack ($387.5M, 2026-09-24) wasn't a key leak — it was a supply-chain attack. Compromised third-party software led to stolen admin-backend credentials, which were used to push forged withdrawal commands: a small test withdrawal first, then multiple hot wallets drained in under 20 minutes.

I wanted to understand the mechanism well enough to rebuild both the attack and the defense, so I did.

What's in it

Matching engine — price-time priority order matching, the kind of thing that comes up in systems-design interviews at exchange-style companies.

Withdrawal defense — three independent layers modeled on what actually would have stopped Bitget:

Velocity check (flags request bursts in a short window)
Multi-approval (large amounts can't clear on one admin's authority)
Timelock (large withdrawals are delayed, not instant)

There's also a TWAP oracle demo reproducing the Tectonic hack (Cronos, 2026-08-30) — a ~100x price pump used to borrow against inflated collateral.

Try it

Everything runs in the browser against fake data — never a working exploit.

Live demo: https://breachlab-5xg.pages.dev/en/
Source: https://github.com/goalsgo1/breachlab

What's next

A new incident gets added only if it passes three checks: the mechanism is explainable in 3 steps or fewer, it's safely reproducible with fake data, and it's being actively discussed. Not a product for real exchange operators — this is a learning resource and portfolio project.

Feedback welcome.

I built a tool that catches an active Steam rating decline before it snowballs (and tells you why)

이해민 — Sun, 09 Aug 2026 09:25:40 +0000

The problem

Steam's "Overwhelmingly Positive" badge is an all-time average. It can stay green for weeks after a patch, a pricing change, or a broken launch actually tanks a game's rating. Most devs find out from an angry tweet or a Reddit thread, not from Steam itself.

I'd already built a similar review-mining tool for the App Store (a "copy+10%" market-research Actor — different post, different audience). Same week, I wondered: does Steam expose anything as clean as Apple's public RSS/Lookup endpoints? Turns out yes — better, actually.

What Steam gives you for free

Two public, zero-auth endpoints:

https://store.steampowered.com/appreviews/<appid>?json=1&filter=recent
https://store.steampowered.com/appreviewhistogram/<appid>?l=english

The first gives you individual reviews with voted_up (boolean, no star-rating math needed), playtime_at_review, refunded, written_during_early_access — much richer than I expected. The second gives you a rolling histogram of recommendations_up / recommendations_down per period (weekly for active games, monthly for older ones), which is the actual key to detecting a real decline instead of noise.

The bug that mattered

I first tried Steam's documented day_range parameter to window the query_summary to "last N days." It doesn't do anything — I tested it against a game with 800K+ reviews spanning two years, day_range=30 and no day_range at all returned byte-identical totals. Not documented as broken anywhere I could find, so noting it here in case it saves someone else the debugging time.

The appreviewhistogram endpoint is the actual fix: compare the most recent period's positive % against a baseline of prior periods, with a minimum-volume gate (I use 20 reviews/period) so a slow week on a small indie title doesn't get mistaken for a crisis.

Real result

Ran it against a game that had a rough launch week. Flagged an active decline immediately, and the negative-review sample broke down as 43% bugs/performance + 18% server issues — i.e., a genuine stability problem, not a subjective "the game isn't fun" wave. That distinction is the whole point: a balance-patch complaint is a design conversation, a wave of bug reports is a fire to put out today.

Try it

It's a pay-per-run Actor on Apify: https://apify.com/muddy_snowshoe/steam-review-miner (~$0.03/game analyzed). Point it at your own App ID to get an early-warning system, or a competitor's for market research.

Genuinely interested in feedback from anyone who's lived through a real Steam rating crisis — does the "active decline" threshold match what you actually experienced, especially around timing (how many days after the triggering event did it become visible in the data)?

How I mine App Store reviews to find "copy+10%" opportunities (open Actor)

이해민 — Sat, 08 Aug 2026 22:34:28 +0000

When evaluating a "copy and improve by 10%" app idea, reading competitor reviews one app at a time doesn't scale. So I built App Store Review Miner, an Apify Actor that:

Pulls the top-grossing chart for any App Store category/country
Fetches each app's recent reviews
Classifies low-rated (≤3★) reviews into 13 complaint buckets
Ranks which complaints are category-wide (real opportunity) vs single-app issues
Flags apps with a "reputation drop" — recent reviews meaningfully worse than their all-time rating

Try it: https://apify.com/muddy_snowshoe/app-store-review-miner

Built with plain Node.js + Apple's public RSS/lookup endpoints, wrapped as an Apify Actor. Source structure and pricing details in the Store listing. Feedback / feature requests welcome — Google Play support is next if there's demand.