Somebody logged in as Chad
The account omgchad belonged to a TWiT host, and on TWiTcraft it was effectively the keys to the building. At about half past six on a Monday evening it logged in, and for the next thirty minutes it went through the server like weather.
It handed a few people ten septillion coins. It filled inventories and chests with diamonds and diamond blocks. Then it went to the nether and the End and started running arbitrary world-edit wipes, cutting sections out of the map including the bedrock around the return portal, and spawning withers — about a dozen of them — while flicking in and out of vanish, so some people watched it happen and some only found the holes afterwards.
SkyerCorp posted the photographs first, at 15:24, under a cheerful title: TWiTCraft Epic Wither Battle. “Some parts in the overworld. Some parts in the end. Lots of devastation. Many brave warriors.”
Four hours later the tone in the thread had changed completely.
Who/whatever spawned those withers caused a lot of damage in West Leoville. I hope someone looks into how this happened and what can be done to prevent it in the future.
— PosterAnonymous, 19:30
What he said.. what hurts the community, hurts me. The wreckage from these Wither attacks has damaged a lot of property. I abhor this.
— Warriorbox, 19:32
VanDerProtofsky, who had been out answering reports of leftover withers, added that there was too much damage across too many separate areas to roll back quickly. FreonKnight said the thing everyone was thinking: “if it was one mod doing it, it's disrespectful to the other mods that have to deal with the modreqs and complaints this incident caused.”
At 19:46 blendermf — Matthew Fraser — posted five sentences that only deepened the mystery:
We're aware of this issue, and are actively working on it. It was not a mod.
Warriorbox, two minutes later: “Who else but a mod can do that?”
The answer, and the man who got blamed
The answer arrived at 20:21. A bug had recently been found in vanilla Minecraft's authentication logic that let a client bypass the check that proves you are who you say you are. TWiTcraft was running an affected version. Anyone who knew about it could log in as anyone.
But by then the community had already worked out who did it, and they were wrong. The timing pointed at Cheetozzz, who had been in and out of Mumble for three minutes immediately before the withers appeared, and who was one of the few people known to have had access to Chad's login. The early spawning had looked jokey. It fitted.
He was accused, and then two separate people came back and apologised in public, unprompted, at length. This is most of one of them:
I'll just take a moment to apologize here to Cheetozzz. It was not his fault. My sincere apologies for anything I have done to make cheetozzz feel that I am blaming him for a massive disruption to our world. I assumed at first that it was something that he caused due timing and to the initial jokey nature of some of the spawning I came across... I should not have leaped to the conclusion that he was to blame.
I also will apologize unreservedly to Cheeto... at the time, the circumstantial situation pointed directly to his name, but I understand now that he was chasing some suspected grief, so his coming into mumble and twitcraft right at that time was just a wild although not totally unrelated coincidence.. We were all totally shocked that someone cause such havoc as a prank.... We all believed that only a mod could have done it.... now we know better... lesson learned.. sorry Cheeto.
— Warriorbox, 03:19
PosterAnonymous closed the subject the following morning with a Monty Python witch trial, carefully labelled “!!! WARNING !!! The following is a joke”, proposing a device for determining whether Cheeto was responsible for future griefing and concluding “Though, why bother... Burn him anyway!!!” asim0v replied: “Also, he turned me into a newt...”
Three hours of server log
At ten to midnight Curley posted the whole thing. It opens with an apology for the writing and ends with a TL;DR, and in between it is one of the more honest incident reports you will read anywhere.
Ok, apologies first for how much this post is going to end up being word vomit cause my mind is fried from staring at a the server log for 3 hours and parsing just what happened.
He took the blame without hedging — “we had an affected version running, this was 100% my fault and I take full blame for the time and trouble lost due to the exploit” — and then made the point that everyone else had missed:
I can't understate enough that WE GOT OFF LUCKY. If the turd had any real knowledge of the way I run things he could have done a lot worse. He only had about 30 mins of time causing mischief.
The money was reverted. Some accounts had been given so many coins that the number overflowed and corrupted; those were reset to zero and handled one at a time. Nobody was banned for receiving money, because “it seemed to come from the benevolent chaddington”. A few players who had knowingly joined in were.
The diamonds were the hard part, because they had already moved — sold in shops, handed over, dropped in chests. He could have traced every transaction in the log. He decided not to:
For the most part, our plan is simply the honor system of twit. If you know or suspect you have a chunk of cheated in items we asked that you simply destroy them or, hell, do something fun like whole a tournament or scavenger hunt or whatever. Turn a bad day into something awesome for the server.
And the End could not be fixed at all, because world-edit keeps no log and has no undo. So he put it to a vote. Option 1: leave it, rebuild the bad parts by hand, “Also, DRAGON!” Option 2: wipe it and restore the last full backup, from 3 August, five weeks earlier. He linked a strawpoll and said he would act as soon as there was a majority.
What people did about it
The honour system worked, which is not the way these things usually go.
helicologo, who had joined days earlier with PyxisGirl and was worried a rollback would erase the small house they had just built together, handed back $56,000 and the diamond blocks anyway:
This suck because Pyxisgirl and myself just started and a roll back may get rid of every thing we have done.. But what we have built is kinda small.. but it is our little “home”... I feel like a part of a community..A good one And will gladly stand by what everyone thinks is best. To rebuild is part of life.. Even in Game.
Warriorbox had two diamond blocks thrown at her by a stranger and gave them straight back: “I don't take sweets from strangers :¬)”
Timberwolf1777's shop had bought a great many of the free diamonds at full price from people who did not know where they came from. He offered to destroy them all the moment he was reimbursed the roughly $60,000 of his own money that he had paid out. Curley's reply quoted himself from the moderators' channel:
oh hey, check out good guy timber, he insisted on paying for the free diamonds
Not everything was recoverable. Four days later someone reopened the question of the older backup, because ipodparf's enderman grinder — a public one, shared by a group of friends — had been deleted along with every chest inside it, and with it six stacks of diamonds and the ability of one shop to stock books, tools and armour at all. torontomario, reading that thread, put in a modreq asking whether the enderman farm he had just started could please be spared.
The dragon nobody ordered
They took option 1. Rather than restore a five-week-old backup, vantes regenerated the land at spawn in the End to fill in the world-edit holes. He had not thought about what that would do.
I didn't realize that regenerating the actual location of spawn would also spawn the dragon. The trigger that spawns the Enderdragon is the generation of the land at spawn, this usually only happens once, the first time somebody enters the end.
So when I regen'd spawn, the game de-activated the portals back to the overworld and spawned the Enderdragon. We were forced to kill the Enderdragon to get a portal back to the over world.
— vantes
They were stuck in the End with a dragon and no way home. SkyerCorp died unarmed three times before the three of them regrouped and went back in properly armoured. Warriorbox got the egg.
She posted about it at 02:26, eight hours after she had written “what hurts the community, hurts me” in the other thread, and this is the last word on the day:
Its been a day of firsts; my first sight of a Wither, and it had to be so many of them and attacking our community, my first sight of an Ender Dragon and coming home with the egg.... I think I fired the last shot, but I don't know, and it was a huge team effort.
I hope that tomorrow will be a more peaceful day.
The hunt became a tradition. They named the dragon Shelldon. In October, Timberwolf1777 walked SkyerCorp to the stronghold and then confirmed it had been SkyerCorp's arrow, so the egg was his.
the fight · vantes explains · Warriorbox · October's hunt
Sources: forum threads t876, t877 and t878, read in full, plus the September 2013 town hall recording at [00:37], where the room thanks Timberwolf1777 for killing the withers while he is not there to hear it. Quotes are exact.