Crypto casino Duelbits loses about $7M from hot wallets in suspected private-key compromise
Duelbits crypto casino hot wallets
On 24 September 2026 crypto casino Duelbits had hot wallets drained across Ethereum, BNB Chain, Tron, Bitcoin and Solana. Co-founder Joe called it a hack of about $7M; other estimates run from about $4.2M (Scam Sniffer, early) to about $6M (CertiK), and Rekt traced about $6.07M. Scam Sniffer and SlowMist point to a leaked private key, but Duelbits has not published a root cause. The site reopened on 27 September and said user funds were safe.
Why this severity: $7.0M reported stolen.
- Started
- Sep 24, 2026
- Closed
- Sep 27, 2026
- Reported stolen
- $7.0M
Indicators · never visit or send to these
- 0xA77e24Fe29d16E051e487ef4Ea7b056cb05aef76
- 0x181A638038A4bD75c207d080DE83e217f8e8a1d7
- 0x8dB9D7f0a03d212c566Ca80c66e294CeCC20C306
- TAvraZZFCZbDSZoyqWWRRsBkFgZqKaCGbK
- A3EBrhMBEGzcPgmbwywSPhW39G6PFGrorU8ib99T6yKw
What to do now
- Use only the official Duelbits site you have bookmarked.
- Ignore 'refund', 'airdrop' or 'compensation' links on X, Telegram or Discord, and never connect a wallet to claim one.
Stay safe
Am I affected?
Duelbits players: the stolen funds came from the casino's own hot wallets, and Duelbits says user balances were safe. Your own wallet is only at risk if you act on a fake 'refund' or 'compensation' link.
What to do now
- Use only the official Duelbits site you have bookmarked.
- Ignore 'refund', 'airdrop' or 'compensation' links on X, Telegram or Discord, and never connect a wallet to claim one.
How to avoid this
- Keep only what you are actively using on custodial casino or trading sites.
- For platforms: keep hot-wallet balances small, keep keys in MPC or hardware security modules, and alert on large outflows.
Timeline 3
Rekt reported that no root-cause report had been published, traced about $6.07M, and noted an earlier $4.6M Duelbits hot-wallet breach in February 2024.
SourceDuelbits reopened at 05:04 UTC with deposits and withdrawals enabled.
SourceDuelbits hot wallets were drained across five chains; Scam Sniffer called it a suspected private-key compromise and SlowMist listed private key leakage.
Source
News & write-ups ›1
How this method works
A private key or seed phrase ends up somewhere readable: code on GitHub, an env file, a hacked server or cloud notes. Bots find it within minutes. Read about leaked private keys and seed phrases →
Follow new drains and updates in your feed reader or Telegram RSS bot.