Inside Bilibili: How a Former Front‑End Engineer Sabotaged User Accounts

Among many software vulnerabilities, the hardest to prevent is “human poisoning”. A recent video by a Bilibili user exposed a severe security incident targeting Bilibili accounts.

The attack triggers when a user opens a Bilibili video on the web: the page instantly switches to a blank white screen and displays a red warning “Your account has been banned”.

After the warning appears, the compromised account begins deleting its previously uploaded videos at a rate of three to four per second, starting from the newest video. Deleted videos cannot be recovered.

Investigation revealed that the malicious code was inserted by a former Bilibili front‑end engineer, Ni (a pseudonym), who was responsible for the DanmakuX (bullet‑screen) engine. The insider allegedly added the code out of personal revenge after a dispute with other users.

The employee has been dismissed, the incident reported to regulatory authorities, and internal disciplinary actions taken. The case highlights that cybersecurity is not only a technical issue but also a human one, urging both companies and individuals to take security seriously.