Duelbits Confirms $7 Million Hot Wallet Breach, Takes Platform Offline
Crypto casino Duelbits has acknowledged a cybersecurity incident resulting in the theft of approximately $7 million from its hot wallets, forcing the platform to suspend operations while investigators assess the breach. The company confirmed the attack on September 24, 2026, after blockchain security firm Scam Sniffer detected suspicious withdrawals totaling $4.2 million across Ethereum, BNB Chain, and Tron.
The attackers drained assets from multiple wallets, including 836 ETH (~$2.3M), 593,000 USDT, 97,000 USDC, 31,500 DAI, and 12.4 billion SHIB on Ethereum, along with 209 BNB and 192,000 TRX on other chains. An additional 8.1 BTC was later identified as stolen from Duelbits’ Bitcoin hot wallet, bringing the total loss to $7 million. Most stolen funds were consolidated into 2,234 ETH (~$6M) in a single address, a tactic that simplifies control but leaves a traceable on-chain trail.
Duelbits co-founder Joe stated that customer funds remain secure and that the platform will resume operations after completing its investigation and replenishing affected wallets. The company has not yet released a root-cause analysis, though security researchers suspect a private-key compromise a scenario where attackers gain control of wallet-signing credentials rather than exploiting a smart-contract flaw.
The platform’s recovery plan includes rotating credentials, rebuilding transaction infrastructure, and launching "Duelbits 2.0" to enhance security. Engineers are currently reconstructing deposit and withdrawal servers, with an estimated 15-hour timeline for restoration. While Duelbits has not disclosed the initial access vector or whether third-party investigators are assisting, the company has committed to issuing an official statement within 24 hours.
The incident highlights the risks of hot wallet custody in cryptocurrency platforms, where rapid fund consolidation by attackers can complicate recovery efforts. Duelbits has urged users to rely only on verified channels for updates amid potential phishing risks following the breach.
Source: https://cyberpress.org/duelbits-confirms-7-million-hot-wallet-hack/
Duelbits TPRM report: https://www.rankiteo.com/company/duelbits
"id": "due1790324844",
"linkid": "duelbits",
"type": "Breach",
"date": "9/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': 'Gambling/Cryptocurrency',
'name': 'Duelbits',
'type': 'Crypto casino'}],
'attack_vector': 'Private-key compromise',
'customer_advisories': 'Customer funds remain secure; platform to resume '
'operations after investigation and wallet '
'replenishment.',
'data_breach': {'data_exfiltration': True,
'sensitivity_of_data': 'High (financial assets)',
'type_of_data_compromised': 'Cryptocurrency assets'},
'date_detected': '2026-09-24',
'date_publicly_disclosed': '2026-09-24',
'description': 'Crypto casino Duelbits confirmed a cybersecurity incident '
'resulting in the theft of approximately $7 million from its '
'hot wallets, forcing the platform to suspend operations while '
'investigators assess the breach.',
'impact': {'brand_reputation_impact': 'High',
'data_compromised': 'Hot wallet assets (cryptocurrency)',
'downtime': '15 hours (estimated)',
'financial_loss': '$7 million',
'operational_impact': 'Platform suspended, transaction '
'infrastructure rebuilding',
'systems_affected': 'Hot wallets, deposit and withdrawal servers'},
'investigation_status': 'Ongoing',
'lessons_learned': 'Highlights risks of hot wallet custody in cryptocurrency '
'platforms; rapid fund consolidation by attackers '
'complicates recovery efforts.',
'motivation': 'Financial gain',
'post_incident_analysis': {'corrective_actions': 'Rotating credentials, '
'rebuilding transaction '
'infrastructure, launching '
"'Duelbits 2.0' for enhanced "
'security.',
'root_causes': 'Suspected private-key compromise '
'(not yet confirmed)'},
'recommendations': 'Enhance hot wallet security, implement multi-signature '
'controls, and improve incident response protocols.',
'references': [{'source': 'Scam Sniffer'}],
'response': {'communication_strategy': 'Official statement within 24 hours, '
'verified channels for updates',
'containment_measures': 'Platform suspended, credentials rotated',
'incident_response_plan_activated': True,
'recovery_measures': 'Replenishing affected wallets, '
'reconstructing deposit/withdrawal servers',
'remediation_measures': 'Rebuilding transaction infrastructure, '
"launching 'Duelbits 2.0'"},
'stakeholder_advisories': 'Users urged to rely only on verified channels for '
'updates amid potential phishing risks.',
'title': 'Duelbits Hot Wallet Breach',
'type': 'Data Breach',
'vulnerability_exploited': 'Hot wallet credentials'}