Crypto Casino Duelbits Goes Offline After $7 Million Hot Wallet Hack

Crypto casino Duelbits has taken its platform offline after hackers drained roughly $7 million from hot wallets spread across multiple blockchains. The attacker targeted wallets holding Ethereum, Bitcoin, stablecoins and other cryptocurrencies before converting much of the stolen crypto into Ether and consolidating approximately $6 million into a single address.

Duelbits Confirms $7 Million Hack

Duelbits confirmed the security breach on September 24 after blockchain security researchers detected unusual transfers from wallets connected to the crypto gambling platform.

Duelbits co-founder Joe said the company is still investigating exactly what happened but maintained that user funds are safe. The platform will remain offline while the investigation continues and its hot wallets are replenished.

Early findings show the attack spread across several blockchain networks:

• Roughly $7 million was stolen, according to Duelbits
• Hot wallets on Ethereum, BNB Chain, Tron and Bitcoin were affected
• Approximately 8.1 BTC was drained from a Bitcoin hot wallet
• 836 ETH was transferred from an Ethereum wallet
• Stablecoins including USDT, USDC and DAI were also stolen
• Roughly $6 million is now sitting as ETH in one address

Security researchers currently suspect the attacker obtained access to private keys controlling the wallets, although Duelbits has not yet confirmed the exact attack method.

Hackers Empty Duelbits Hot Wallet

The Ethereum portion of the attack happened quickly.

Onchain data showed a Duelbits-labeled wallet transferring approximately 836 ETH, 593,000 USDT, 97,000 USDC, 31,500 DAI and 12.4 billion SHIB to the attacker within minutes. Less than $25 worth of ETH remained in the wallet afterward.

Blockchain security firm Scam Sniffer initially detected suspicious transfers involving Ethereum, BNB Chain and Tron before identifying an additional loss of 8.1 BTC.

Other security researchers have reported different preliminary loss estimates as additional wallets and blockchains have been identified, but Duelbits itself has publicly confirmed an overall loss of approximately $7 million.

Stolen Crypto Converted Into Ethereum

Most of the stolen assets didn’t remain in their original form.

The attacker converted much of the crypto into Ether and consolidated the funds into a newly created Ethereum address containing approximately 2,234 ETH, worth around $6 million at the time of reporting.

The funds had not moved from that address when CoinDesk published its report.

Converting assets such as USDT and USDC into ETH can also make recovery more difficult. Centralized stablecoin issuers can potentially freeze tokens held at identified addresses, while ETH does not have a central issuer with the same ability.

That makes the attacker’s next onchain move particularly important as blockchain investigators continue tracking the funds.

Private Keys May Be Behind the Attack

Early evidence points toward a possible private-key compromise.

A private key effectively controls access to a crypto wallet. If an attacker obtains it, they can authorize transactions from the wallet without needing to exploit the underlying blockchain or find a vulnerability in a smart contract.

SlowMist currently classifies the Duelbits incident as a suspected private-key leak.

Crypto gambling platforms have faced similar attacks before. In 2023, Stake lost approximately $40 million after attackers compromised its hot wallets, an incident later attributed by U.S. authorities to North Korea’s Lazarus Group.

Duelbits Remains Offline

Duelbits says it took the entire platform offline as a precaution while its team determines how the wallets were compromised.

There is currently no announced reopening time. The company says it intends to complete its investigation, replenish the affected hot wallets and then bring the platform back online.

The incident once again highlights the tradeoff surrounding hot wallets. Keeping crypto online gives platforms immediate access to funds for withdrawals and other transactions, but it also creates a valuable target if wallet credentials are compromised.

For Duelbits, the immediate focus is now determining how an attacker gained access to wallets across multiple blockchains and whether the roughly $6 million currently sitting in one Ethereum address can be recovered before it begins moving again.