Duelbits and Gamdom Hacks: What Players Should Check

Duelbits put the hot-wallet loss from its 24 September 2026 breach at about $7 million, and 19 days later Gamdom lost what its founder now estimates at $4.27 million. Both casinos then reopened within three days. However, both figures are the operators’ own estimates, and Gamdom’s later admissions about player data changed what its account holders need to check.

The two hacks and what followed

In both cases, the incident, its public confirmation and the full account of the damage arrived on different days. For example, Gamdom’s founder confirmed the wallet breach on 14 October, the day after the theft. The company’s admissions about player data then came after the site had already reopened.

Duelbits hack: $7 million and a three-day outage

On 24 September, Duelbits took its site offline when attackers drained its hot wallets, the internet-connected wallets a casino uses to send and receive crypto. Co-founder Joe estimated the loss at about $7 million, according to Unchained, and also said customer funds were safe while the team rebuilt its payment systems.

Researchers also reported suspicious movements across several blockchains and suspected a private-key compromise. However, that is a likely route rather than a finished forensic finding. As a result, the cause of the Duelbits breach is still open in public.

Deposits and withdrawals then came back on 27 September, according to VIP-Grinders' incident comparison, which also records about $8 million across Duelbits wallets after the reopening. Later, CEO Jasper discussed the response in an interview with Gambling Lore published on 1 November. He also said the team had to handle deposits players sent to saved wallet addresses while the site was down, and admitted that Duelbits could have communicated more. The interview, however, did not set out a technical root cause.

"Trust is more than just your hot wallet. There's a lot more to trust." — Jasper, CEO, Duelbits, to Gambling Lore, 1 November 2026

Still, a visible wallet balance only shows what sits in that wallet. It does not, for example, show whether an operator can cover every customer balance at once.

Gamdom hack: what the later disclosures changed

The wallet theft

Gamdom then went offline on 13 October. According to Bitcoin.com, staff found unauthorised access to an automation server while they were investigating a suspected disk failure. Founder Felix Römer first put the loss at just over $3 million, while investigator vxdb estimated about $4.2 million. Gamdom also said it moved the remaining hot-wallet assets into cold storage. The site then came back on 16 October, according to VIP-Grinders.

What our Gamdom wallets recorded

Meanwhile, our on-chain collector was reading 13 wallets we label as Gamdom's. On 13 October (UTC), $17.41 million left those wallets, 2.3 times the $7.58 million of the day before. In addition, $14.96 million of that moved in transfers of $50,000 or more. Then activity almost stopped: no outflows on 14 October and $2,022 on 15 October. Flows finally resumed on 16 October, when Gamdom reopened, with $12.73 million coming in.

However, that $17.41 million is not the theft total. Instead, it combines whatever the attacker took with the operator's own transfers, including the move of remaining hot-wallet funds into cold storage that Gamdom described. Our data cannot separate the two, so the stolen amount still rests on the company's $4.27 million estimate and vxdb's $4.2 million. In contrast, our Duelbits history starts on 26 September, two days after its breach, so we have no matching record of that day.

The ransom claim

Next, on 26 October, the group WhiteArmor demanded $15 million in Bitcoin and claimed access to about 15.4 million accounts. Gambling Lore's report on the demand also separated the person claiming to hold the data from the group publicising it. Neither, however, established who carried out the wallet theft.

Gambling Lore then checked selected records: one requested account record, plus support tickets and attachments linked to a member of its own team. As a result, those checks show genuine access to particular records. However, they cannot show the size or completeness of the whole dataset.

Gamdom's own figures

Gamdom's position then moved. In a founder interview held on 29 October and published on 31 October, Römer gave Gambling Lore a revised theft estimate of about $4.27 million. Gamdom's team also said its database logs showed roughly 16 million player records extracted, slightly more than the 15.4 million in the ransom claim, and about 7,000 identity-verification (KYC) documents exposed through its support platform.

Admittedly, these are company figures. In addition, a record count does not tell you how many distinct people are affected. Still, the admission replaces Römer's earlier rejection of the 15.4 million claim.

Also, the ransom demand is separate from the stolen money. Gambling Lore reported a threatened release date of 9 November; however, as of 10 November, we found no report that a full release took place or that anyone paid. Therefore, neither outcome should be assumed from the deadline passing.

What the evidence can tell players

In short, each kind of evidence answers a different question. For example, a casino's statement shows what the casino says. Likewise, a researcher's transaction trace can confirm particular movements. Similarly, a journalist's check of a record shows access to that one record. However, none of them on its own shows that every account, system or balance is secure.

Reserves and solvency

We also found no public, independently verified report for either operator that sets reserves against customer liabilities. That is a limit of our search, not evidence that no such document exists. Moreover, even where one exists, the PCAOB's investor advisory warns that proof-of-reserve reports can leave out liabilities, and a snapshot of assets says nothing about access to funds later.

Balances, working withdrawals and an operator's ability to pay are related but different. First, your displayed balance is what the platform records for you. Second, a completed withdrawal shows that one payment went through. Neither, however, shows that every customer could withdraw at the same time.

The limits of our wallet data

Our own wallet data has limits too. The labels for both casinos are provisional, and coverage is incomplete, so a quiet day can mean a missing wallet rather than a quiet casino. Our wallet methodology and coverage notes therefore explain how we label wallets and what we leave out.

Six account checks players can make

These checks cover the part of account security a player controls. They also reduce the risk of account takeover and scams. However, they cannot secure a casino's own wallets or servers.

1. Replace reused passwords and secure your email

First, use a long, unique password for the casino account, and change it anywhere else you reused it. Secure the linked email account too, because account recovery usually runs through it. For example, CISA recommends unique passwords and a password manager. Gamdom's own account compromise procedure also tells affected users to change both their account and email passwords.

2. Turn on app-based two-factor authentication

Next, set up an authenticator app through the official account settings; CISA's MFA guidance explains why it matters. For instance, Duelbits' security guide puts it under Profile → Security, and Gamdom's 2FA page lists Settings → Security → Two-Factor Authentication. Also keep recovery codes private, because a code request that arrives in a message is not the same as a prompt inside an account you opened yourself.

3. Review balances and recent activity

Then go through withdrawals, deposits and other account activity for anything you do not recognise. Keep the transaction references, then contact official support if something is wrong. Besides, a casino's general reassurance does not settle an individual discrepancy. Likewise, a successful login does not mean earlier activity on the account was yours.

4. Copy the current deposit address every time

Take the address and network shown inside your account before you send crypto. Jasper's account of deposits sent to saved addresses during the Duelbits outage shows why this matters. Therefore, do not reuse an old saved destination, and ignore replacement details sent in an unsolicited message.

5. Treat recovery messages with suspicion

Instead of following a link, open the official site yourself to check a supposed refund, security notice or verification request. Never give passwords, authentication codes or a wallet recovery phrase to someone claiming to be support. After all, leaked account data can make a scam message sound convincing, and CISA's phishing guidance lists the common signs. In other words, knowing details about your account does not make the sender genuine.

6. Limit the balance you leave with the operator

No amount is guaranteed safe on a casino. Instead, keep only what you plan to use if you play, and withdraw the rest through the official process to a wallet you control. However, account security does not remove gambling losses or custody risk. Our casino security checklist covers further checks, and our crypto casino guide also explains the difference between payment security, custody and game fairness.

FAQs

About the two hacks

Keeping your account safe