Intraverse.io, a web3 gambling and bot-farm platform, exposed its production Firebase Realtime Database without any authentication, revealing 16.9 million records containing sensitive user and operational data, according to cybersecurity tracking from Bitsight.
The misconfigured database, discovered on August 17, was accessible to anyone who knew the correct URL, requiring no credentials or tokens to read its contents. Firebase Realtime Database is a Google Cloud service commonly used by mobile and web applications to store and sync data in real time. When properly configured, access is restricted by Firebase security rules, but Intraverse.io’s instance was left completely open.
A Growing Pattern of Firebase Misconfiguration
Firebase misconfigurations have emerged as one of the most persistent sources of mass data exposure in recent years. Google’s own infrastructure is not at fault; rather, developers leave databases public by failing to implement authentication rules. In February 2026, a separate Firebase misconfiguration exposed 300 million private messages from 25 million Chat & Ask AI users. BreachHistory records show that the 2018 wave of Firebase exposures affected roughly 110 million records across thousands of mobile applications.
Intraverse.io markets itself as a web3 ecosystem offering games like Voxmons and Variance, with blockchain-based asset ownership. The platform describes a “bot farm” capability that allows users to automate interactions across web3 applications. The exposed database potentially contained user profiles, session data, and internal operational records tied to these bot operations.
No Indication of Public Notification
As of August 18, there was no public disclosure from Intraverse.io regarding the exposure or any remediation steps. The company’s main website and play portal remained operational. Security researchers note that Firebase exposures of this scale frequently go unreported by the affected organization, as developers may be unaware that their database rules were misconfigured.
The incident follows a string of high-profile data exposures this month, including a SafePal crypto wallet breach affecting 40,000 users, a Trezor shipping partner breach impacting over 13,000 customers, and a TaxAct.com incident exposing 450,000 user records. The pace of disclosures has accelerated through mid-August, with ransomware groups such as Qilin, LockBit, and TheGentlemen posting dozens of new victims on leak sites daily.
Sources: Bitsight Data Breach Tracker; Hackread; SecurityWeek
discussion