Crypto Casino Duelbits Loses $7 Million in Hot-Wallet Hack, Goes Offline

Duelbits, a crypto gambling platform, lost about $7 million on September 24 after hackers broke into its hot wallets. The company took its site offline within hours of the breach. Blockchain security firm Scam Sniffer spotted the first signs of trouble that morning. It watched wallets on three chains send funds to brand-new addresses around 5:52 a.m. ET.

Duelbits confirmed the breach publicly later that same day. The platform had been running normally right up until the outflows started, giving users no warning before withdrawals and deposits froze.

Wallets Drained Across Four Chains

Scam Sniffer first flagged roughly $4.2 million in unusual outflows from Duelbits wallets on Ethereum, BNB Chain and Tron. Investigators later found a fourth leak. Another 8.1 BTC left a separate Bitcoin hot wallet, pushing the total closer to $7 million. The Ethereum wallet alone sent out 836 ETH, about 593,000 USDT, 97,000 USDC, 31,500 DAI and 12.4 billion SHIB within minutes.

Most of the stolen tokens were swapped into ether and moved into one address holding roughly 2,234 ETH. A live check of that wallet against current CoinGecko pricing, with ETH near $2,638, puts the consolidated stash at close to $5.9 million. The balance sat untouched there as of this writing.

DeFiLlama's own hack tracker lists the incident as a hot wallet key compromise. It targets Duelbits as a gambling platform specifically. The tracker records a total loss of $7 million, matching the figure Duelbits gave its own users directly.

Joe, Duelbits' co-founder, confirmed the roughly $7 million hack on X hours after Scam Sniffer's alert went out.

Duelbits Says User Funds Are Safe

Duelbits co-founder Joe posted the confirmation on X the same afternoon. "Confirming a ~$7M hack. Still investigating exactly what happened and how," he wrote. He added that the site would stay offline until the team had clarity. He said user funds remained safe throughout.

Joe laid out three next steps. First, finish the investigation. Second, refill the drained hot wallets. Third, bring the platform back online before launching what he called Duelbits 2.0. He promised to keep posting updates as he had them.

Replies under the post show him fielding blunt criticism from users about the platform's security history. He answered several of them directly rather than staying quiet, a departure from how some hacked platforms handle bad news.

Part of a Rough Month for Custodians

The breach adds to a rough month for centralized crypto platforms. Bitget disclosed its own hot wallet compromise on the very same date. It later raised its loss estimate to roughly $387.5 million as withdrawals stayed paused for days.

DeFiLlama's hack tracker shows private key and hot wallet compromises behind several of September's largest crypto thefts. Duelbits was a comparatively small platform among them, but the mechanism looks identical. A private key gets exposed somewhere, and funds move out within minutes.

For now, players cannot deposit, withdraw, or place bets on Duelbits until engineers finish rebuilding the platform's wallet infrastructure. Joe has not detailed how the private keys were exposed in the first place, and Duelbits has not named the attacker. Both remain open questions while the investigation continues.

Duelbits operates as an online crypto casino and sportsbook, taking wagers directly in Bitcoin, Ethereum and other tokens rather than fiat currency. That business model depends on hot wallets staying online for instant deposits and payouts. Attackers targeted exactly that infrastructure. Users with pending balances will need to wait for the platform's return before they can move funds again.