Author here. This is a post-mortem of a bot attack on our game. The game itself is an endurance contest: one million squares, one person each, and you confirm before your window closes — 24 hours at the start, one minute
   at the end. Miss once and you are out.

   We are publishing this because we promised transparency from the start, and that has to include the part where we got outplayed twice in two days. Every number is checkable against the live board.

   The ending is in the post: we invalidated every session on the site, so confirming a window required signing in through Telegram again. All 553 remaining farm squares went dark in the next window — not one of those accounts re-authenticated. The registration flow was fully automated; the re-login flow apparently was not.

   Happy to answer technical questions about the detection queries, the session invalidation, or why we think a captcha is no longer a meaningful defense.