Crypto casino Gamdom faces $15M ransom demand after data breach claim

What happened

Cyber extortion group WhiteArmor published a ransom demand on October 26 claiming access to Gamdom's user database containing over 15.4 million accounts. According to reports from Crypto.news and Bitcoin.com News, the group alleged that it accessed the database through an old internal machine account that retained administrative privileges despite years of disuse. WhiteArmor stated the compromised data spans 146 different fields per account and published a sample containing approximately 100 account records as evidence.

The extortion group is demanding $15 million in Bitcoin and threatened to publicly expose the data if payment is not made. In addition to the database claim, WhiteArmor alleged that the combined profit values associated with the compromised accounts exceeded $1 billion, though the group did not explain how this figure was calculated or what timeframe it covered.

Gamdom founder Felix Romer has disputed WhiteArmor's claims about the scope of the breach. Romer stated that attackers accessed only a few hundred accounts rather than the entire database as alleged. Subsequent statements from Romer acknowledged possible exposure of usernames, email addresses, and gambling activity while asserting that identity verification documents remained unaffected. The platform had temporarily suspended operations following a separate security incident before resuming on October 16.

Why it matters

The alleged breach exposes a significant vulnerability at a major crypto gambling platform and raises questions about the security of user data in the cryptocurrency industry. If WhiteArmor's claims are verified, the compromise of over 15 million accounts would represent one of the largest data breaches at a crypto platform, potentially affecting millions of users' personal information and gambling histories. The unresolved dispute over the breach's actual scope leaves customers uncertain about whether their data has been exposed and could eventually appear in public databases or be sold to other bad actors.

Background

WhiteArmor is a relatively new cyber extortion operation that began appearing on cybersecurity monitoring platforms in October 2026. According to threat intelligence records from HackerFeeds, the group first appeared in tracked victim listings on October 21, just days before publishing the Gamdom ransom demand. The operation has presented itself as a data theft group and reportedly runs an affiliate program allowing participating attackers to retain 95% of successful ransom payments. WhiteArmor has claimed responsibility for breaches at other companies including Whirlpool, J.B. Hunt, and LoveSac, though those listings do not confirm that the intrusions were successful.

The ransom demand against Gamdom follows a separate security incident on October 13 involving the platform's cryptocurrency hot wallet. At that time, Gamdom founder Felix Romer acknowledged losses exceeding $3 million, while blockchain analysts estimated the stolen funds at approximately $4.2 million. Hot wallets are internet-connected storage systems used to process transactions, making them convenient for withdrawals but exposing them to greater security risks than offline storage methods. The earlier attack attracted attention from blockchain investigator ZachXBT, who traced stolen assets linked to FreedomXMR, a cryptocurrency exchange service where over 87% of incoming funds were associated with suspected illicit activity including ransomware payments and exploits.

What to watch

The outcome of WhiteArmor's ransom demand and whether Gamdom verifies the actual scale of the alleged breach remain uncertain. Neither the complete database nor its claimed size has been independently verified by security researchers outside the platform or the extortion group. Additionally, it is unclear whether Gamdom will make any ransom payment or pursue other remediation strategies. The situation highlights ongoing risks facing cryptocurrency platforms and the growing threat posed by organized cyber extortion operations targeting the sector.