A complete case-opening website. Full source code.

Players top up a balance, open cases, win items, gamble them in an upgrader, sell them back to the site or withdraw the money. Every part of that loop is here and working: the payments, the game, the anti-fraud, the admin tooling, the legal pages, the support desk.

This is not a template. This exact code ran in production and took real money from real users for two weeks in August 2026. The site is offline now, its domain released and its player database gone, and I say that in the first paragraph on purpose: you are buying an engine that survived contact with real players, not a business with traffic. What that engine went through is documented below in numbers you can verify yourself.

Live demo

Login demo (at) megadrop.local, password demo12345. The balance is already funded, so you can open cases the moment you land. Add lang=en to the address for the English version. Admin panel credentials on request. Payments on the demo run on test details, so nothing real moves.

The three box scenes

Nine of the twelve cases open as a reel. The other three do not, and they are the reason players kept coming back.

Small, Big and Mega are full opening scenes. A box is not one prize but a series of independent draws, one, three and ten of them. The main section always comes first: coins, then power points, then rare items. Only after it, and only if something dropped, comes the bonus section with tickets, gems and a duplicator. Nothing plays on its own and nothing is skipped for you. Every reward waits for the player to tap, and a tap during an animation fast-forwards it to its final state instead of swallowing the input.

Under the scene there is a working draw system. A luck counter raises the legendary chance every thirty draws and resets in proportion to the rarity of whatever finally lands. A pity rule guarantees an item after a run of empty draws. A character cannot be drawn twice inside one box, or at all if the player already owns it. When an entire rarity has been collected out, it stops taking part in the draw and its probability is redistributed across the rest through a lambda ladder that leaves the average payout of a draw exactly where it was. In plain terms: a completionist cannot drift the RTP of your site by finishing a collection. Two audit tools ship with the code so you can confirm that rather than trust it.

The animation was not written by feel. Phase timings inside each stage were taken frame by frame at 60 fps from reference recordings, which is why the box lands with weight, shakes and bursts instead of sliding through a CSS transition. Coins, power points, star power and bonus rewards each get their own full-screen stage, and the run closes on a summary. Particles run on canvas from a preallocated object pool, so nothing is allocated per frame, the garbage collector stays quiet and the scene holds its frame rate on a phone. Sprites are optional; without them the particles are drawn procedurally.

Every asset path, caption and sound key lives in a manifest rather than in the scene code, so all three boxes are re-skinned to your own theme without a line of JavaScript being touched. Opening several at once splits the screen into two or four panes, each running a complete independent copy of the scene with its own taps, its own summary and its own crediting.

The rest of the game

Twelve cases in three families and 520 loot entries spread across them. The reel opens one, three, five or ten at a time with sound. The upgrader lets a player stake an item or cash against a more expensive reward and shows the chance formula on screen while they decide. Inventory with stacks, sell-one and sell-all, plus character level progression.

Money

Deposits by bank transfer, card and USDT in four networks, with a live crypto rate from one source, a fallback to a second, and a manual override with your own markup. Withdrawals are debited the moment the request is created rather than when it is paid, so nobody can spin the same money through cases while an admin walks to the bank.

Before a withdrawal there is a wagering requirement of one and a half times the deposit, and gifted money is tracked separately from earned: free cases, promo codes, referral bonuses and starting balance cannot be cashed out until they are played, while a player's own money leaves without conditions. Every movement of every unit of currency is written into a ledger with a stitched balance chain, so each row carries what the balance was and what it became, and a separate tool hunts for any break in that chain. Promo codes come in personal and public flavours with a depositors-only condition, and the referral program pays both sides.

Accounts and anti-fraud

Three sign-in methods: email with a confirmation code, Google and Telegram. Argon2 password hashing, sessions in the database, CSRF on every endpoint that touches money, rate limiting on login. Against multi-accounting there are four independent layers - device signals, fingerprint, IP subnet and email canonicalisation - which caught 44 fake accounts out of 1066 in production. The rules are deliberately not spelled out in the interface, since that would be a manual for getting around them. A ban carries a reason the player can read and closes the session immediately. Streamer mode masks email, ID and Telegram handle on screen.

Telegram bot

Account linking and a channel-subscription check that unlocks a free case. Deposit and withdrawal requests arrive in the chat with approval buttons, so an admin settles them from a phone. Support runs through the same bot: a player writes, the message reaches every admin with the account data attached, any admin answers with a reply and the answer lands back with the player. There is a command to write to a player first, without waiting to be asked. Admin commands are invisible to players because the command menu is installed per admin chat rather than globally. Runs on polling, or on a webhook when you would rather not keep a second process alive.

Admin panel

A real web panel on its own host. The main domain answers the admin address with a plain 404 rather than a 403, because a 403 would confirm the panel is there.

The payout percentage of every case is edited live from the browser, separately for regular players and for VIPs. Any single item can be switched off inside a case, and the chances of everything else renormalise themselves. The panel answers before you save: payout, house margin and the chance of every row are recomputed on the spot, with the old and the new value side by side until you commit. Reel cases display the corridor of payouts that is actually reachable and say so when a target falls outside it, instead of silently clamping to the edge. For the box scenes the payout is an estimate and is labelled as one, and a Measure button runs a real background simulation that returns the number with an error margin. Beyond the odds: player management, balance corrections, deposit and withdrawal queues, and charts.

Legal pages

Six documents - terms, privacy, payments, fair play, responsible gaming and FAQ - each on a real address served with a 200 rather than a modal on the home page. Age gate and cookie bar included. The terms text is wired to the actual settings in the code: with withdrawals disabled, the relevant section states that balances are not paid out; enabled, it describes how they are. The odds published on the fair play page are generated from the same table the draw runs on, so there is no second copy of the numbers waiting to contradict the first.

What it did in production

The numbers below came out of the live database on 15 August 2026, after thirteen days of operation, via a read-only script that ships with the code. You can reproduce every one of them.

• 1066 registered players, 81 of whom paid
• 7.6 percent conversion from registration to payment
• 23.5 percent of payers paid more than once
• 6220 cases opened
• 44 multi-accounts caught and banned by the anti-fraud
• All traffic from TikTok streams on a brand-new account, with no advertising budget at all

And the honest shape of it: revenue spiked in the middle of that stretch and fell roughly four and a half times by the last three days. That is what one burst of traffic looks like, not organic growth, and the full day-by-day table ships with the code. Thirteen days is also too short to measure retention, so I claim none.

Technical

• Python 3 and Flask on the backend. Not PHP, not Django.
• Plain JavaScript and plain CSS on the frontend. No npm, no build step, no framework to migrate away from later.
• SQLite out of the box, PostgreSQL with a single environment variable. MySQL is not used.
• Telegram bot on aiogram, polling or webhook.
• 482 automated tests covering the economy, the ledger, wagering, anti-fraud, promo codes, the admin panel and localisation. One command runs them.
• About 113500 lines of code: 30600 Python and 82900 JavaScript, CSS and HTML.
• Deploys to any VPS, Railway or Render. A local demo takes three minutes.
• One responsive layout for desktop and mobile, with no separate mobile build to maintain.
• Documentation included: deployment checklist, architecture handbook, asset replacement guide, localisation map, and a settings example with every key explained.

Read this before you buy

• No payment gateway. Deposits arrive on your own bank or crypto details and are credited manually with a button in the bot. In production only 42 percent of deposit requests survived that manual step, which makes a real gateway the most obvious revenue upgrade waiting for a buyer.
• The player-facing site is fully bilingual, Russian and English, with a switch. The admin panel, the bot, the legal texts, the server messages and the code documentation are Russian only, and the exact coverage map is in the docs.
• The package ships with placeholder character art. Images are swapped without touching code, and the procedure is documented.
• No licence and no legal entity. Real money plus a random outcome is regulated gambling in most countries; compliance is entirely on you.
• The economy has not been calibrated on real money yet. In production almost the whole in-game turnover was gifted balance rather than deposits, so the payout ratio observed there is not a number to plan on. The admin panel exists precisely so that you can set your own.
• Sold as source code, as is, under a single-site licence, with installation support included.