[Urgent] Onamae.com VPS Hijacking Incident — The “EA that loses on its own” is Devouring Your Account. All essential measures you must take immediately

Hello, this is Chicken Farm.

Our motto is “keeping the chickens (accounts) alive.” We have valued not chasing the market, but surviving above all.

But this time, the chicken coop door was pried open from a place completely unrelated to the market.

To be honest. I myself had MT4 running 24 hours on a Onamae.com VPS. When I saw the news, my spine chilled. I immediately changed all passwords and migrated away from the VPS.

This isn’t someone else’s problem. It’s a story that concerns everyone running EAs.

■ What happened — 26,000 servers were affected simultaneously

On October 21, GMO Internet announced that the third party had intruded into the FX automated trading VPS “Onamae.com Desktop Cloud” and installed unauthorized programs on some servers.

The servers that could be affected totaled 26,739.

From 4 a.m. that same morning, all servers on all plans were progressively stopped. In other words, tens of thousands of traders’ EAs stopped abruptly one morning. Some people held positions when it stopped.

Moreover, it’s said that information inside the servers may have been viewed.

■ “DEMOFASTLOSS” — the nightmare of an EA that loses on purpose

The truly terrifying part starts here.

On X (formerly Twitter), users began to cry out one after another. There are reports of losses ranging from tens of thousands to over a hundred thousand yen from trades they don’t recognize.

And in one victim’s report, the name “DEMOFASTLOSS” appeared.

An EA that intentionally incurs losses, trading on its own.

Normal EAs are built to win. But this EA is built to lose. It’s a tool to dissolve your account as quickly and as surely as possible.

*These are individual victim reports and have not been officially confirmed.

■ Why it would cause a loss — suspecting the attacker's goal

With FX accounts, it isn’t easy for the attacker to withdraw money directly. Withdrawals are restricted to accounts in the attacker’s own name.

So what’s the plan?

Intentionally make the victim’s account lose big, while the attacker prepares a winning account on the opposite side. This way, the victim’s money flows to the attacker as a “result of the trades.”

This has long been a method used in stock and FX hijacking cases. It’s possible they automated it with EAs and targeted many accounts at once.

Also, some reports say the access origin was an IP from Finland. However, such things usually go through VPNs or compromised servers, so it doesn’t reveal the attacker’s location.

■ Why EA users were targeted

The reason is simple.

To run an EA on a VPS 24 hours, MT4 must be set to “remember password and log in.” In other words, the VPS stores the account number and password together.

Once the VPS is breached, it’s as if the keys to the accounts were handed over.

Moreover, those who use EAs tend to adopt a “set-and-forget” approach. Many don’t check their accounts for days. For the attacker, there is no more convenient target.

■ Attacks in the AI era are fast and wide

The exact path of this intrusion has not been disclosed yet. It’s not known whether AI was used.

Nevertheless, in general, attackers are evolving their tools. They look for weaknesses, build attack mechanisms, process thousands of machines simultaneously. This work is getting faster and cheaper.

From the era of guessing passwords one by one to the era of sweeping everyone up at once. The defenders must also change their mindset.

■ What to do now — a 5-minute check-list

If you haven’t done this yet, please do it before you close this article.

Change FX account passwords (for trading and investor accounts)
Change all reused passwords (email, vendor member pages, GoGoJion, etc.)
Enable two-factor authentication (where available on vendor member pages)
Check all accounts’ trading history from around October 20 onward
Be wary of counterfeit emails/phone calls (phrases like “we will compensate you” or “for confirmation, please provide password” are fraud indicators)

If you notice suspicious trades, contact your provider’s support immediately. The sooner, the easier the investigation will progress.

■ Pitfalls of VPS switching

When switching, you may want to copy the MT4 folder from the old VPS as-is. Settings and history are convenient to keep.

But please don’t.

There may be malicious files mixed in. Even after moving, you’d be taking the thief with you.

Install MT4 fresh on the new VPS, and only transfer the EA files from your own computer. That is safer.

■ Chicken Farm’s method to watch over accounts

From here, I’ll share methods I actually use or started because of this incident.

① Monitor from your smartphone with investor password
The investor password is for viewing only; you cannot trade with it. If you register the investor password in the MT4 app on your smartphone, you can monitor your account from anywhere even if you lose your phone. It’s separate from the VPS.

② Remember the faces of “unknown trades”
Know your EA’s magic number, the currency pairs you use, and usual lot sizes. If you spot unfamiliar trades, you’ll notice quickly. Unused currency pairs, sudden large lots, unknown comments — these are red flags.

③ Check balance once daily
The appeal of EA is “you can leave it alone.” But you should only leave the trading decisions alone. Don’t leave the account itself unattended. A daily balance check with your morning coffee can reduce damage.

④ Use AI as a watchdog
If attackers evolve their tools, defenders can too. Use AI to read your trading history and check for unusual trades. Anyone can start doing this today.

■ Survival is not just winning in the market

Chicken Farm has always prioritized “survival.” Number of averaging down, lot sizes, stop losses, time stops — all to prevent your account from being wiped out.

But this incident reminded us clearly.

No matter how carefully you craft an EA, no matter how meticulously you manage funds, if your account keys are stolen, it can all end in one night.

Security to protect your accounts is as important as risk management in trading.

Protecting your chickens isn’t just about feed and coop space. You also need doors that foxes cannot enter.

We sincerely sympathize with those who have been affected by this incident. We hope compensation and investigations move in a favorable direction.

And may the chickens of everyone who reads this article stay healthy and active tomorrow as well.

Chicken Farm

※This article is based on publicly available information as of October 22, on individual posts on X, and general security concepts. Intrusion routes and methods are speculative. Please refer to GMO Internet's official announcements for the latest information.