Duelbits $7 Million Hot Wallet Hack: Suspected Key Compromise Drains Crypto Casino Across Four Chains

On September 24, 2026, attackers drained approximately $7 million from the hot wallets of crypto casino Duelbits across several blockchains. The platform took its website offline as a precaution. Co-founder Joe confirmed the loss: "Confirming a ~$7M hack. Still investigating exactly what happened and how. Until we have clarity, Duelbits stays offline."

The theft was first flagged by Scam Sniffer, with PeckShield also detecting suspicious transactions. Researchers initially identified approximately $4.2 million leaving hot wallets on Ethereum, BNB Chain, and Tron, sent to newly created addresses. Scam Sniffer later reported that a Bitcoin hot wallet had also lost 8.1 BTC. The approximately $7 million overall figure comes from Joe's confirmation, not from the researchers' on-chain tallies.

According to CoinDesk, the Ethereum hot wallet sent 836 ETH, about 593,000 USDT, 97,000 USDC, 31,500 DAI, and 12.4 billion SHIB to the attacker within minutes, leaving it with less than $25 in ether. These figures describe part of the theft, not the full $7 million. The attacker swapped most of the stolen assets into ether and consolidated them in a single new address holding approximately 2,234 ETH, worth about $6 million at the time. As of CoinDesk's report, those funds had not moved onward.

Joe said user funds were safe and that the platform would stay offline until the investigation progressed and its hot wallets were replenished. On September 26, FairGambling reported that Duelbits was lining up $7.7 million to refill its operational wallets. On September 27, Duelbits announced its return with deposits and withdrawals live, saying it had relaunched with about $8 million across hot and cold wallets.

Duelbits has not published a root cause. Its initial statement said the team was still investigating what happened and how. Security researchers, including Scam Sniffer, suspected a private key compromise, but this has not been confirmed by the company.

Why researchers suspect key compromise

The pattern fits. Funds left hot wallets on four unrelated blockchains (Ethereum, BNB Chain, Tron, and Bitcoin) through ordinary transfers. There is no shared smart contract across those networks that a single bug could explain. A wallet that sends its entire balance across several tokens within minutes, to a freshly created address, is behaving exactly as it would if someone else held its signing key. The Ethereum hot wallet being left with less than $25 suggests a deliberate, complete sweep.

// Duelbits Ethereum hot wallet (0x014435b1...5cc9b)
// Sent to the attacker within minutes:
eth       =            836 ETH
usdt      =       ~593,000 USDT
usdc      =         97,000 USDC
dai       =         31,500 DAI
shib      = 12,400,000,000 SHIB
remaining =   < $25 in ETH

// Other chains (Scam Sniffer / PeckShield):
initial_flagged = ~$4.2M across Ethereum, BNB Chain, Tron
bitcoin         = 8.1 BTC from a Bitcoin hot wallet

// Most assets swapped to ETH and consolidated:
attacker_address = 0x8db9d7f0...cc20c306
holding          = ~2,234 ETH (~$6M at the time), not yet moved

// Confirmed total (Duelbits co-founder): ~$7M

A familiar pattern for crypto casinos

Crypto casinos keep large hot wallet balances because players expect instant deposits and withdrawals across many assets. That operational need makes them attractive targets. CoinDesk noted that Stake, the largest crypto casino by volume, lost $40 million in 2023 through a similar private key compromise. Swapping stolen stablecoins into ETH quickly, as happened here, also matters: USDT, USDC, and DAI held in the attacker's address could potentially be frozen by their issuers, while ETH cannot.

• Keep hot wallet balances tied to real withdrawal demand. A casino needs liquidity for payouts, but not necessarily millions per chain at all times. Automated top-ups from cold storage, sized to recent withdrawal volume, cap what any single key compromise can take.
• Use MPC or HSM-backed signing for hot wallets. If a single private key can empty a wallet, protecting that key is the whole security model. Multi-party computation or hardware security modules mean no single machine or person holds a usable key, so one compromised server or laptop is not enough.
• Enforce withdrawal rules at signing time. A transaction sending a wallet's full balance of several tokens to a brand-new address should never be signed automatically. Destination allowlists, per-transaction limits, and velocity checks at the signer would have stopped or slowed the sweep.
• Monitor outflows across all chains together. Duelbits lost funds on four networks at roughly the same time. Correlated monitoring that pauses all hot wallets when one shows abnormal outflows can limit losses on the chains hit later, such as the Bitcoin wallet identified after the first wave.
• Have issuer contacts ready for stablecoin freezes. Roughly $700,000 in USDT, USDC, and DAI left the Ethereum wallet alone. Fast freeze requests to issuers, before the attacker swaps to ETH, are one of the few ways to recover value after a hot wallet drain.
• Publish a post-mortem before or soon after relaunch. Duelbits reopened three days after the theft without a public root cause. Users and other operators benefit from knowing what failed and what changed, especially when the same platform is asking customers to deposit again.