{
 "tag": "private-key-compromise",
 "name": "Private Key Compromise",
 "group": "Other",
 "incidents": [
  {
   "slug": "duelbits-hot-wallet-drain-sep-2026",
   "title": "Crypto casino Duelbits loses about $7M from hot wallets in suspected private-key compromise",
   "url": "https://drains.watch/i/duelbits-hot-wallet-drain-sep-2026",
   "json": "https://drains.watch/i/duelbits-hot-wallet-drain-sep-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "ethereum",
    "bsc",
    "tron",
    "bitcoin",
    "solana"
   ],
   "method": "key-leak",
   "product": "Duelbits crypto casino hot wallets",
   "tags": [
    "ethereum",
    "bsc",
    "tron",
    "bitcoin",
    "solana",
    "key-leak",
    "casino",
    "gambling",
    "hot-wallet",
    "private-key-compromise",
    "duelbits"
   ],
   "amountUsd": 7000000,
   "victims": null,
   "startedAt": "2026-09-24",
   "closedAt": "2026-09-27",
   "updatedAt": "2026-10-06T12:00:00Z",
   "summary": "On 24 September 2026 crypto casino Duelbits had hot wallets drained across Ethereum, BNB Chain, Tron, Bitcoin and Solana. Co-founder Joe called it a hack of about $7M; other estimates run from about $4.2M (Scam Sniffer, early) to about $6M (CertiK), and Rekt traced about $6.07M. Scam Sniffer and SlowMist point to a leaked private key, but Duelbits has not published a root cause. The site reopened on 27 September and said user funds were safe."
  },
  {
   "slug": "stablr-1of3-multisig-key-may-2026",
   "title": "StablR's EURR and USDR depeg after attacker takes over 1-of-3 minting multisig with a stolen key",
   "url": "https://drains.watch/i/stablr-1of3-multisig-key-may-2026",
   "json": "https://drains.watch/i/stablr-1of3-multisig-key-may-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "key-leak",
   "product": "StablR EURR and USDR stablecoins and holders",
   "tags": [
    "ethereum",
    "key-leak",
    "stablr",
    "eurr",
    "usdr",
    "stablecoin",
    "multisig",
    "1-of-3",
    "private-key-compromise",
    "depeg"
   ],
   "amountUsd": 2800000,
   "victims": null,
   "startedAt": "2026-05-23",
   "closedAt": "2026-05-24",
   "updatedAt": "2026-05-24T12:00:00Z",
   "summary": "On 23-24 May 2026 an attacker used the compromised private key of one signer on StablR's 1-of-3 minting multisig to add themselves as owner, replace the other owners and mint 8.35M USDR and 4.5M EURR, about $13.5M face value. They dumped about $10.4M of it on DEXs for ETH, with early net proceeds estimated at $2.8M, pushing USDR as low as $0.40 and EURR to about $0.85. ZachXBT said he helped freeze a six-figure sum."
  },
  {
   "slug": "resolv-usr-minting-key-compromise-mar-2026",
   "title": "Resolv's USR stablecoin depegs after attacker uses a compromised signing key to mint 80M unbacked tokens",
   "url": "https://drains.watch/i/resolv-usr-minting-key-compromise-mar-2026",
   "json": "https://drains.watch/i/resolv-usr-minting-key-compromise-mar-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "key-leak",
   "product": "Resolv Labs USR stablecoin and holders",
   "tags": [
    "ethereum",
    "key-leak",
    "resolv",
    "usr",
    "stablecoin",
    "depeg",
    "private-key-compromise",
    "off-chain-signer",
    "minting"
   ],
   "amountUsd": 24500000,
   "victims": null,
   "startedAt": "2026-03-21",
   "closedAt": "2026-04-01",
   "updatedAt": "2026-04-01T12:00:00Z",
   "summary": "On 21 March 2026 an attacker obtained a privileged private key used by Resolv's off-chain minting service, deposited about $100K-$200K in USDC and minted about 80M USR, which the contracts did not cap. They swapped out for about 11,408 ETH, roughly $24.5M, and USR fell to about 26 cents. Resolv paused its app, offered the attacker a 10% bounty and asked holders not to trade USR while it works on recovery."
  },
  {
   "slug": "whale-safe-1of1-key-compromise-nov-2025",
   "title": "Whale's 1-of-1 Safe multisig drained of $27M+ after key compromise, ETH laundered via Tornado Cash",
   "url": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025",
   "json": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "key-leak",
   "product": "Private whale's Gnosis Safe multisig (Ethereum)",
   "tags": [
    "ethereum",
    "key-leak",
    "gnosis-safe",
    "multisig",
    "private-key-compromise",
    "aave",
    "tornado-cash",
    "whale"
   ],
   "amountUsd": 27300000,
   "victims": 1,
   "startedAt": "2025-11-04",
   "closedAt": "2026-01-06",
   "updatedAt": "2026-01-06T12:00:00Z",
   "summary": "A private whale's Gnosis Safe on Ethereum, set up so a single signature could approve transactions, was taken over and drained of about $27.3M according to PeckShield; Hacken's forensics say losses may exceed $40M. Ownership passed to the attacker six minutes after the Safe was created on 4 November 2025, and the thief laundered ETH through Tornado Cash in batches while slowly unwinding a leveraged Aave position. A multisig with one signer is only as safe as that one key."
  }
 ],
 "changes": [
  {
   "incident": "duelbits-hot-wallet-drain-sep-2026",
   "incidentTitle": "Crypto casino Duelbits loses about $7M from hot wallets in suspected private-key compromise",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-10-06",
   "title": "Rekt reported that no root-cause report had been published, traced about $6.07M, and noted an earlier $4.6M Duelbits hot-wallet breach in February 2024.",
   "sourceUrl": "https://rekt.news/duelbits-rekt",
   "url": "https://drains.watch/i/duelbits-hot-wallet-drain-sep-2026"
  },
  {
   "incident": "duelbits-hot-wallet-drain-sep-2026",
   "incidentTitle": "Crypto casino Duelbits loses about $7M from hot wallets in suspected private-key compromise",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-09-27",
   "title": "Duelbits reopened at 05:04 UTC with deposits and withdrawals enabled.",
   "sourceUrl": "https://rekt.news/duelbits-rekt",
   "url": "https://drains.watch/i/duelbits-hot-wallet-drain-sep-2026"
  },
  {
   "incident": "duelbits-hot-wallet-drain-sep-2026",
   "incidentTitle": "Crypto casino Duelbits loses about $7M from hot wallets in suspected private-key compromise",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-09-24",
   "title": "Duelbits hot wallets were drained across five chains; Scam Sniffer called it a suspected private-key compromise and SlowMist listed private key leakage.",
   "sourceUrl": "https://rekt.news/duelbits-rekt",
   "url": "https://drains.watch/i/duelbits-hot-wallet-drain-sep-2026"
  },
  {
   "incident": "stablr-1of3-multisig-key-may-2026",
   "incidentTitle": "StablR's EURR and USDR depeg after attacker takes over 1-of-3 minting multisig with a stolen key",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-05-24",
   "title": "StablR acknowledged an exploit on X about eight hours after on-chain activity stopped; Blockaid attributed it to one signer's compromised key on a 1-of-3 multisig.",
   "sourceUrl": "https://theblock.co/post/402429/stablrs-eurr-and-usdr-depeg-after-attacker-mints-13-5-million-in-unbacked-tokens-through-multisig-exploit",
   "url": "https://drains.watch/i/stablr-1of3-multisig-key-may-2026"
  },
  {
   "incident": "stablr-1of3-multisig-key-may-2026",
   "incidentTitle": "StablR's EURR and USDR depeg after attacker takes over 1-of-3 minting multisig with a stolen key",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-05-23",
   "title": "ZachXBT flagged the exploit at 9:46 PM ET after the attacker minted 8.35M USDR and 4.5M EURR through the minting multisig.",
   "sourceUrl": "https://theblock.co/post/402429/stablrs-eurr-and-usdr-depeg-after-attacker-mints-13-5-million-in-unbacked-tokens-through-multisig-exploit",
   "url": "https://drains.watch/i/stablr-1of3-multisig-key-may-2026"
  },
  {
   "incident": "resolv-usr-minting-key-compromise-mar-2026",
   "incidentTitle": "Resolv's USR stablecoin depegs after attacker uses a compromised signing key to mint 80M unbacked tokens",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-04-01",
   "title": "Halborn's March review attributed the roughly $23M loss to a compromised key of an off-chain service, with no on-chain check on mint amounts.",
   "sourceUrl": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-march-2026",
   "url": "https://drains.watch/i/resolv-usr-minting-key-compromise-mar-2026"
  },
  {
   "incident": "resolv-usr-minting-key-compromise-mar-2026",
   "incidentTitle": "Resolv's USR stablecoin depegs after attacker uses a compromised signing key to mint 80M unbacked tokens",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-03-23",
   "title": "Resolv temporarily paused its app and later enabled redemptions while contacting verified holders.",
   "sourceUrl": "https://therecord.media/hacker-breaches-resolv-defi-25-million",
   "url": "https://drains.watch/i/resolv-usr-minting-key-compromise-mar-2026"
  },
  {
   "incident": "resolv-usr-minting-key-compromise-mar-2026",
   "incidentTitle": "Resolv's USR stablecoin depegs after attacker uses a compromised signing key to mint 80M unbacked tokens",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-03-21",
   "title": "Using a stolen privileged signing key, the attacker deposited roughly $100K-$200K in USDC, minted about 80M unbacked USR and traded it for about 11,408 ETH; USR fell to about 26 cents.",
   "sourceUrl": "https://therecord.media/hacker-breaches-resolv-defi-25-million",
   "url": "https://drains.watch/i/resolv-usr-minting-key-compromise-mar-2026"
  },
  {
   "incident": "whale-safe-1of1-key-compromise-nov-2025",
   "incidentTitle": "Whale's 1-of-1 Safe multisig drained of $27M+ after key compromise, ETH laundered via Tornado Cash",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-06",
   "title": "Laundering continued: about 6,300 ETH had been routed through Tornado Cash while the attacker withdrew collateral from a leveraged Aave position in stages.",
   "sourceUrl": "https://www.theblock.co/post/384441/crypto-hacker-launders-more-eth-from-compromised-multisig-as-27m-exploit-unfolds-peckshield",
   "url": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025"
  },
  {
   "incident": "whale-safe-1of1-key-compromise-nov-2025",
   "incidentTitle": "Whale's 1-of-1 Safe multisig drained of $27M+ after key compromise, ETH laundered via Tornado Cash",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-12-18",
   "title": "PeckShield reported about $27.3M drained via a private key compromise, with about 4,100 ETH already sent through Tornado Cash.",
   "sourceUrl": "https://cointelegraph.com/news/attacker-seizes-whale-multisig-drains-40m-in-stages",
   "url": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025"
  },
  {
   "incident": "whale-safe-1of1-key-compromise-nov-2025",
   "incidentTitle": "Whale's 1-of-1 Safe multisig drained of $27M+ after key compromise, ETH laundered via Tornado Cash",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-11-04",
   "title": "The Safe was created at 07:46 UTC and ownership passed to the attacker six minutes later; a first 1,000 ETH went to Tornado Cash that day, per Hacken.",
   "sourceUrl": "https://cointelegraph.com/news/attacker-seizes-whale-multisig-drains-40m-in-stages",
   "url": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025"
  }
 ]
}