# Crypto casino Duelbits loses about $7M from hot wallets in suspected private-key compromise

- Severity: Critical · Status: Contained (past)
- Chains: Ethereum, BNB Chain, Tron, Bitcoin, Solana · Method: Leaked private keys and seed phrases
- Started: Sep 24, 2026 · Last update: Oct 6, 2026 · Reported stolen: $7.0M
- Who/what: Duelbits crypto casino hot wallets

On 24 September 2026 crypto casino Duelbits had hot wallets drained across Ethereum, BNB Chain, Tron, Bitcoin and Solana. Co-founder Joe called it a hack of about $7M; other estimates run from about $4.2M (Scam Sniffer, early) to about $6M (CertiK), and Rekt traced about $6.07M. Scam Sniffer and SlowMist point to a leaked private key, but Duelbits has not published a root cause. The site reopened on 27 September and said user funds were safe.

## Am I affected?
Duelbits players: the stolen funds came from the casino's own hot wallets, and Duelbits says user balances were safe. Your own wallet is only at risk if you act on a fake 'refund' or 'compensation' link.

## What to do now
- Use only the official Duelbits site you have bookmarked.
- Ignore 'refund', 'airdrop' or 'compensation' links on X, Telegram or Discord, and never connect a wallet to claim one.

## How to avoid this
- Keep only what you are actively using on custodial casino or trading sites.
- For platforms: keep hot-wallet balances small, keep keys in MPC or hardware security modules, and alert on large outflows.

## Indicators (block these, never visit them)
- Address: 0xA77e24Fe29d16E051e487ef4Ea7b056cb05aef76
- Address: 0x181A638038A4bD75c207d080DE83e217f8e8a1d7
- Address: 0x8dB9D7f0a03d212c566Ca80c66e294CeCC20C306
- Address: TAvraZZFCZbDSZoyqWWRRsBkFgZqKaCGbK
- Address: A3EBrhMBEGzcPgmbwywSPhW39G6PFGrorU8ib99T6yKw

## Sources
- Duelbits - Rekt (Rekt News, 2026-10-06): https://rekt.news/duelbits-rekt

Full record: https://drains.watch/i/duelbits-hot-wallet-drain-sep-2026 · JSON: https://drains.watch/i/duelbits-hot-wallet-drain-sep-2026.json

Rules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support.