Duelbits crypto hack drains $7M, forcing platform offline

1 hour ago 17

A popular online betting platform for crypto users has gone dark after attackers siphoned millions of dollars from its wallets, reviving old questions about how well crypto casinos actually protect the money that flows through them. The Duelbits crypto hack, confirmed by the platform itself, drained roughly $7 million from hot wallets spread across four different blockchains, forcing the site offline while its team works out exactly what went wrong.

Key takeaways

Duelbits confirmed a roughly $7 million hack and took its platform offline as a precaution.
Hot wallets on Ethereum, BNB Chain, Tron and Bitcoin were compromised in what security researchers believe was a private key breach.
About 2,234 ETH, worth close to $6 million, has been consolidated into a single address and has not moved since.
Co-founder Joe said user funds are safe and that the site will stay down until wallets are refilled and the probe wraps up.
Blockchain security firm Scam Sniffer was the first to flag unusual outflows from Duelbits’ wallets.

Duelbits Crypto Casino Suffers $7 Million Hot Wallet Hack

Duelbits lost close to $7 million after attackers cleared out its hot wallets on Thursday, a breach that pushed the crypto gambling site to shut down operations entirely. The company confirmed the incident directly, rather than letting the news trickle out through blockchain trackers alone.

Details of the Hack and Asset Movements

On-chain data tells much of the story. Etherscan records show the wallet identified as belonging to Duelbits sent out 836 ETH, roughly 1.62M USDT, 97,000 USDC, 31,500 DAI and 12.4 billion SHIB to the attacker within minutes. That wallet, once holding a substantial balance, now sits with less than $25 worth of ether left in it.

Most of what was stolen didn’t stay in its original form for long. The attacker swapped the bulk of the assets into ether and funneled them into a single new address. That address currently holds around 2,234 ETH, worth close to $6 million, and as of publication, none of it had moved further. Whether that stillness means the funds are being watched, laundered slowly, or simply parked for now isn’t clear.

Initial Detection and Impact

Blockchain security firm Scam Sniffer was the one that first spotted trouble, flagging unusual fund outflows from Duelbits’ hot wallets before the company itself put out a statement. According to Scam Sniffer’s reporting, wallets on Ethereum, BNB Chain and Tron all sent assets to freshly created addresses in a pattern consistent with a compromised private key. The firm later added that Duelbits’ bitcoin hot wallet lost approximately 8.1 BTC as well, extending the breach beyond the initial three chains.

Before any of this happened, Duelbits wasn’t exactly a niche player. DappRadar had ranked the platform 17th out of 43 tracked crypto casinos by on-chain deposits, with about $5.7 million spread across its monitored wallets. It remains unclear whether that figure reflects the site’s balances before or after the attack.

Cause and Methodology: Suspected Private Key Compromise

The working theory, based on Scam Sniffer’s findings, points to a suspected private key compromise as the root cause of the breach. In practical terms, that means whoever carried out the attack likely gained direct control over the keys that authorize transactions from Duelbits’ hot wallets, rather than exploiting a smart contract bug or a more elaborate technical flaw.

This method isn’t new to the crypto gambling world. A private key compromise was also the technique used against Stake, the largest crypto casino by volume, back in 2023, when hackers walked away with $40 million. The parallel raises a fair question: is the Duelbits crypto hack an isolated slip-up, or a sign that hot wallet security across crypto casinos hasn’t caught up with the money flowing through these platforms? Two similar breaches years apart, using the same basic method, suggest the latter concern deserves more attention than the industry has been giving it.

Duelbits Response and User Fund Status

Duelbits’ response came fast, at least in terms of communication. Co-founder Joe addressed the breach directly on X, writing: “Confirming a ~$7M hack. Still investigating exactly what happened and how.” He added that “user funds are safe,” a statement meant to reassure customers even as the platform remains offline.

According to Joe, the site will stay down until the investigation concludes and the hot wallets are refilled. Duelbits separately described the situation in a company statement as a “security incident” and said taking the platform offline was a precautionary step rather than a sign that operations were compromised further.

For users, the practical impact right now boils down to a platform they can’t access and a promise, not yet independently verified beyond the company’s own statement, that their balances remain intact. For the wider crypto gambling sector, the episode adds another data point to a pattern worth watching: hot wallets holding millions in liquid crypto assets remain an attractive, and apparently still vulnerable, target.