Recursive withdraw

This is the kind of attack seen on Friday 2016-06-17.