Cryptocurrency gaming platform Duelbits took its website offline after attackers drained approximately $7 million from the platform's hot wallets on Thursday, September 24, 2026. The incident affected wallets across four blockchains: Ethereum, BNB Chain, Tron and Bitcoin. Platform co-founder Joe confirmed the hack on X, stating that user funds are safe while the investigation continues. Blockchain security firm Scam Sniffer was the first to detect the suspicious activity and suggested a private key compromise as the primary attack vector.
Key incident facts: ~$7 million stolen from hot wallets; wallets on Ethereum, BNB Chain, Tron and Bitcoin compromised; 836 ETH, 593,000 USDT, 97,000 USDC, 31,500 DAI and 12.4 billion SHIB drained from the Ethereum wallet; 8.1 BTC lost from the Bitcoin wallet; stolen assets consolidated into a single address holding ~2,234 ETH (~$6 million); funds have not moved since consolidation.
The incident began on Thursday when blockchain analysts detected large outbound transactions from Duelbits hot wallets across several blockchains simultaneously. According to Etherscan data, the Ethereum wallet labeled as a Duelbits hot wallet sent the attacker 836 ETH (approximately $2.2 million at current prices), 593,000 USDT, 97,000 USDC, 31,500 DAI and 12.4 billion SHIB within minutes. After these transactions, less than $25 worth of Ether remained in the wallet, indicating that the hot wallet had been almost completely drained.
Scam Sniffer, a firm specializing in monitoring fraudulent activity in cryptocurrency, was the first to publish an alert about the incident. The company's analysts reported that Duelbits hot wallets on Ethereum, BNB Chain and Tron sent funds to newly created addresses, a pattern consistent with a private key compromise. Scam Sniffer later added that the company's Bitcoin hot wallet had also been affected, losing 8.1 BTC (approximately $480,000 at current prices).
Total losses amounted to approximately $7 million, making the incident one of the largest crypto casino hacks of 2026. For comparison, in 2023, Stake, the largest crypto casino by volume, suffered a similar attack involving a private key compromise, in which hackers stole $40 million. The methodology of the Duelbits attack is nearly identical to the Stake incident, indicating that attackers continue to use proven techniques.
Preliminary analysis points to a private key compromise as the primary attack vector. This method implies that the attackers gained access to the private key controlling the platform's hot wallets, allowing them to authorize transactions without needing to breach the underlying infrastructure itself. Hot wallets, by definition, are connected to the internet to enable fast transactions, making them more vulnerable than cold storage.
After the initial withdrawals, the attackers consolidated the stolen assets. Most of the stolen tokens were swapped for Ether and transferred to a single new address, which currently holds approximately 2,234 ETH worth around $6 million. At the time of publication, these funds had not moved further, which could indicate several scenarios: the attackers may be waiting for attention around the incident to subside, planning to use mixers to launder the funds, or preparing to transfer the assets to other addresses.
Using a single address for consolidation makes the funds easier for blockchain analysts to track, but it may also be part of the attackers' strategy. Consolidation allows the stolen assets to be managed centrally and prepared for the next stage — laundering through decentralized exchanges, cross-chain bridges or specialized mixers such as Tornado Cash. The fact that the funds have not moved since consolidation gives Duelbits and law enforcement a temporary window to potentially track and recover some of the assets through cooperation with exchanges.
Attack methodology: Private key compromise — the same method used in the 2023 Stake hack ($40 million). Hot wallets are inherently more vulnerable than cold storage because they remain connected to the network to facilitate rapid transactions.
Duelbits co-founder Joe responded quickly to the incident, publishing confirmation of the hack on X. In his statement, he confirmed the theft of approximately $7 million and said the company was continuing its investigation to determine the exact circumstances and mechanism of the attack. The most critical statement concerned the safety of user funds: Joe emphasized that customer funds were safe and had not been affected by the hack.
The platform decided to take its website offline until the investigation is complete and the hot wallets are replenished. This precautionary measure is intended to prevent further potential attacks and give the team time to conduct a full security audit, identify vulnerabilities and strengthen its infrastructure. Duelbits' official statement describes what happened as a "security incident" and confirms the platform's temporary unavailability.
Separating platform funds between hot and cold wallets is standard industry practice. Hot wallets hold a limited amount of funds to support daily operations and rapid withdrawals, while the majority of assets are stored in cold storage that is not connected to the internet. If Duelbits' statement regarding the safety of user funds is accurate, this would mean that the majority of customer deposits were held in cold storage and were not affected by the attack.
The Duelbits hack fits into a troubling trend of attacks targeting cryptocurrency gaming platforms, which have become attractive targets because of their high transaction volumes and the significant amounts held in hot wallets to facilitate instant payouts. Crypto casinos process thousands of transactions every day, requiring substantial liquidity in hot storage and creating an attractive target for hackers.
The history of crypto casino hacks shows recurring patterns. The 2023 Stake incident, in which $40 million was stolen through a private key compromise, demonstrated the vulnerability of even the industry's largest players. The attack on Duelbits using the same methodology confirms that attackers continue to exploit proven attack vectors, particularly when platforms fail to implement additional layers of protection for hot wallets.
For the industry, this incident raises important questions about the balance between operational speed and security. Hot wallets are necessary to provide users with fast withdrawals, but they represent a point of vulnerability. Solutions include using multisignature wallets that require multiple signatures to authorize transactions, implementing daily withdrawal limits, using hardware security modules (HSMs) to store private keys and deploying real-time monitoring systems to detect anomalous activity.
| Crypto Casino | Year of Hack | Amount Lost | Attack Vector |
|---|---|---|---|
| Stake | 2023 | $40 million | Private key compromise |
| Duelbits | 2026 | $7 million | Private key compromise |
| Other platforms | 2022-2025 | Various amounts | Various vectors |
The ongoing investigation will show whether the stolen funds are recovered and what security measures Duelbits implements to prevent similar incidents. The crypto gambling industry will continue to face security challenges, and platforms' ability to protect funds will become a key factor in competitive advantage and user trust.
Lessons for the industry: Repeated attacks involving private key compromises demonstrate the need for multi-layered hot wallet protection, including multisignature controls, HSMs, withdrawal limits and real-time monitoring. Balancing operational speed and security remains a critical challenge for crypto casinos.
“In the world of cryptocurrency, security is not a destination but a continuous journey. Every hack is a lesson the industry must learn from in order to become stronger.”
— Andreas Antonopoulos, Bitcoin and security expert
