We Banned 213 Accounts for Engine Abuse — Here Is Exactly What Happened, and Why
Over a 30-day audit window ending May 22, 2026, WeatherBot identified and removed 213 user accounts for sustained abuse of our AI analysis engine. Roughly 85% of those accounts — about 181 of them — geolocated to a single country cluster (India). Collectively they ran our intelligence engine around the clock, day and night, for weeks at a time, generating a five-figure USD infrastructure bill with effectively zero corresponding trading activity. This is the full, transparent account of what we found, what we did about it, and how to reach us if you believe your account was caught by mistake.
We are publishing this report for one reason: WeatherBot treats misuse, manipulation, and resource abuse as serious operational threats — the same way we treat copycats and phishing. We would rather be openly accountable about an enforcement action than let it happen quietly. If you run a legitimate trading session, none of this affects you, and the platform is faster today than it was a week ago because of it.
The action, by the numbers
213 accounts removed
Permanently restricted or banned for sustained, non-productive use of the AI engine over the audit window.
~85% from one region
About 181 of the 213 accounts geolocated to a single country cluster (India), based on connection origin and request fingerprints.
<2% of users, majority of load
These accounts were a tiny fraction of our active base but accounted for the majority of all AI inference calls during the period.
5-figure USD cost
Net compute and third-party API spend attributable to these accounts, against essentially $0 in trading volume.
What “engine abuse” actually means here
To be precise about the behavior we acted on — this was not normal trading, and it was not occasional curiosity. The pattern was unmistakable and consistent across the flagged accounts:
- 24/7 operation, for weeks. The flagged accounts kept the analysis loop running continuously — day and night, with no meaningful pause. Several held the engine active for 20+ hours a day across three or more consecutive weeks.
- Every cycle is expensive. A single analysis pass is not free: it fans out to four independent weather models (GFS, ECMWF, UKMO, NWS) and then hands every surviving candidate to Claude for a senior-meteorologist review. Run that loop around the clock and the call volume compounds into the millions of redundant inference requests.
- Near-zero balances. The funded balance on these wallets was typically under $4, and in many cases effectively zero. The accounts were not sized to ever place a meaningful trade.
- No trades, no outcome. Despite consuming an enormous share of our compute, these accounts produced almost no executed trades and no platform revenue. It was pure cost — load with no corresponding activity.
The simplest way to put it
A small group of accounts ran our most expensive system — the AI engine — non-stop for weeks, on wallets that were never funded to trade. The result was a five-figure bill that returned nothing to them, nothing to us, and degraded performance for everyone else.
What we believe is causing it (and what we don't yet know)
We want to be honest about the limits of our understanding. We have not conclusively identified the root cause. What we can say is what the data most strongly suggests:
The overwhelming likelihood is that these are inexperienced users experimenting with low- or zero-balance wallets — people who connect, start the engine to “see what it does,” and then simply leave it running indefinitely, unaware that the analysis loop they left on is consuming real, metered AI compute on our side every minute it stays active. In other words: not malicious, in most cases — but genuinely harmful to the system and to other users all the same.
We are deliberately not ruling out other explanations, which is part of why this remains an open investigation:
- Scripted / automated sessions that keep the engine alive to bypass our idle protections.
- Shared guides or tutorials circulating in a particular community that instruct users to “leave it on overnight,” producing the geographic concentration we observed.
- Deliberate resource exhaustion — a small minority intentionally driving up our costs. We treat this possibility as real and act on it where the evidence supports it.
The geographic figure (~85% from one region) is a neutral observation from connection-origin data, not a judgment about any user or community. We report it because it is materially relevant to diagnosing and preventing the abuse — nothing more.
How enforcement works — automatic first, manual where needed
The vast majority of abuse never reaches a human. Our systems are designed to catch and contain it automatically:
1. Heartbeat auto-stop
Our browser-heartbeat system already shuts a session down after a short period of inactivity, so a forgotten tab doesn't burn credits indefinitely. Most idle sessions die here, harmlessly.
2. Rate limits & anomaly scoring
Per-account request ceilings and continuous anomaly scoring flag the runaway patterns — abnormal call frequency, around-the-clock uptime, and zero-balance churn.
3. Automatic restriction
When the score crosses a threshold, the account is automatically throttled or restricted — no human required. This is where most of the 213 were first contained.
4. Manual review
For ambiguous cases the system can't confidently classify, a person reviews the account directly and makes the call. These are the bans we took by hand.
The honest reality is that automation handles the clear cases well, but there is always a tail of accounts the system doesn't know how to act on — behavior that looks abusive but could be a legitimate edge case, or vice versa. Rather than guess wrong in either direction, we escalate those to manual review. That is slower and more expensive for us, but it is the only fair way to handle the gray area, and it is why a portion of this action was taken by hand rather than by the engine.
Why this matters for legitimate users
This is not housekeeping — it directly protects the people who use WeatherBot as intended:
- Faster, more responsive analysis. Removing the runaway load frees inference capacity for real trading sessions. Genuine users get their analysis back sooner.
- A sustainable platform. A five-figure leak, repeated month after month, is not survivable indefinitely. Closing it keeps WeatherBot online and investable in — better models, more cities, faster execution.
- A fairer system. Compute is a shared, finite resource. When a tiny minority consumes the majority of it for nothing, everyone else pays for it in latency. Enforcement restores the balance.
Think your account was banned by mistake? Tell us.
Automated enforcement is not perfect, and we know it. If you believe your account was restricted or banned wrongfully, we want to hear from you — and we will review your case personally.
Appeal your account
Email [email protected] with the wallet address tied to your account and a short note describing how you use WeatherBot.
We aim to acknowledge every appeal within 2 business days. If the action was a false positive, we will reinstate your access promptly — no hassle, no penalty. We will never ask for your private key or seed phrase in an appeal, or by any other channel, ever.
The bottom line
WeatherBot is built to be a serious, professional trading tool, and we run it like one. That means protecting the engine, the bankrolls on it, and the experience of every legitimate user — even when the protective action is uncomfortable to publish. We take misuse, manipulation, and resource abuse seriously, we act on the data, and we are transparent when we do.
Questions about this action or your account? Reach the team at [email protected]. The only legitimate WeatherBot is the one you're reading this on — beware of copycats.