Duelbits confirms $7 million hot-wallet hack and extends casino downtime

Crypto casino Duelbits confirmed on September 24 that attackers drained roughly $7 million from its hot wallets and took its site offline. "Confirming a ~$7M hack. Still investigating exactly what happened and how," co-founder Joe wrote on X, adding that user funds are safe, in posts reported by CoinDesk.

The reopening slipped. On Thursday evening Joe said the team had identified what happened and expected the casino back within about 15 hours. By 2:28 p.m. ET Friday he said Duelbits needed more downtime to make sure everything was secure and to refill its hot and cold wallets. Customers will be able to withdraw immediately if they want to, he said, in updates described by Unchained. The company is rebuilding its deposit and withdrawal servers, and Joe promised an official statement within 24 hours of his Thursday post. A Friday morning company post said staff were finishing final security checks. None of the posts has described the cause. Joe has said only that a few people had ruined it for everyone else, without saying who.

Blockchain security firm Scam Sniffer flagged the incident first. At 5:52 a.m. ET it posted that Duelbits hot wallets had sent about $4.2 million to newly created addresses across Ethereum, BNB Smart Chain and Tron, calling it a suspected private key compromise. It later added that the company's bitcoin hot wallet had lost 8.1 BTC, CoinDesk wrote. PeckShield counted about $4.3 million on Ethereum and BNB Chain. Duelbits posted at 7:42 a.m. ET that it was investigating a security incident affecting the site and had shut the site down while it did.

How the funds moved

Etherscan data shows the Ethereum wallet, labelled as a Duelbits hot wallet, sent 836 ETH, about 593,000 USDT, 97,000 USDC, 31,500 DAI and 12.4 billion SHIB to the attacker within minutes, leaving the wallet with less than $25 in ether, according to CoinDesk. Most of the stolen assets were then swapped to ether and consolidated into a single new address holding about 2,234 ETH, worth roughly $6 million, which had not moved onward as of publication.

Unchained traced a similar path with a slightly different total. PeckShield said the attacker had swapped the haul into about 1,588 ETH and 31,500 DAI, and onchain records showed the ether routed into a wallet holding about 2,333.6 ETH, some of it from other addresses, with nothing sent out since, the outlet reported. Duelbits has not publicly said which wallets account for the rest of the roughly $7 million beyond the tracked hot-wallet outflows.

Before the incident, DappRadar ranked Duelbits 17th of 43 tracked crypto casinos by on-chain deposits, with about $5.7 million across its monitored wallets. It was not immediately clear whether those figures reflect balances before or after the outflows, per the same report.

CoinDesk put the scope at four blockchains: Ethereum, BNB Chain, Tron and Bitcoin, according to its reporting. Duelbits called the shutdown a precaution in its statement, saying it was investigating a "security incident" while the site stayed dark.

Several facts remain open. The company has not named the cause, has not accounted publicly for the share of the $7 million beyond the tracked hot-wallet outflows, and has not set a reopening time. The fuller official statement Joe promised has not yet appeared in the material reviewed for this report.

A repeat incident

Duelbits has been hit before. In February 2024, CertiK reported that about $4.6 million was taken from the casino, Unchained wrote. A suspected private key compromise is also the method that hit Stake, the largest crypto casino by volume, in 2023, when hackers took $40 million.

Thursday's attack landed the same day Bitget was hit. Bitget chief executive Gracy Chen said about $351.6 million was taken from that exchange's hot and warm wallets, in a statement cited in the same coverage.