Duelbits Hacked: $7M Drained From Crypto Casino Hot Wallets

Blockchain security firm PeckShield posted the first public alert at about 10:15 UTC on September 24, 2026, followed by Scam Sniffer, which flagged unusual outflows from Duelbits hot wallets on Ethereum, BNB Chain and Tron. Funds were sent to freshly created addresses within minutes, a pattern consistent with a stolen private key rather than a smart contract bug.

Scam Sniffer later reported that the Duelbits Bitcoin hot wallet was also hit, losing 8.1 BTC. That makes four blockchains affected in a single coordinated attack.

Roughly 90 minutes after the first alert, Duelbits called it a security incident and took the platform offline as a precaution. The co-founder then confirmed the figure of about $7 million and said the site would stay down until the investigation finishes and the hot wallets are refilled.

Etherscan data shows the Ethereum wallet labelled as a Duelbits hot wallet sent about 836 ETH, 593,000 USDT, 97,000 USDC, 31,500 DAI and 12.4 billion SHIB to the attacker, leaving less than $25 behind. On BNB Chain and Tron the attacker also took around 209 BNB, additional USDT and about 192,000 TRX.

Early tracker estimates put the loss at about $4.2 million. The higher $7 million total confirmed by Duelbits includes the Bitcoin wallet and the other chains, although the company has not published a per-chain breakdown.

Most stolen tokens were quickly swapped into ether, a common laundering step that avoids stablecoin issuers freezing USDT or USDC. The proceeds were consolidated into one new Ethereum address holding about 2,234 ETH, worth roughly $6 million at the time of reporting.

As of the first reports, those funds had not moved further. On-chain analysts are watching the address closely, since any move to a mixer, bridge or exchange could help investigators trace the attacker.

Duelbits says user funds are safe, meaning the company plans to absorb the loss from its own treasury. A hot wallet only holds the liquid float used to pay out withdrawals, while most reserves at large operators sit in cold storage.

However, no reopening date or withdrawal timeline has been announced. FairGambling estimated nearly $190.6 million in deposits to Duelbits over the previous year from more than 85,000 depositing addresses, so a large number of players are waiting on access to their balances.

The Duelbits incident closely mirrors the September 2023 Stake hack, where attackers used compromised private keys to drain about $40 million from hot wallets. Crypto casinos must keep large sums liquid for instant withdrawals, which makes hot wallet keys one of the most valuable targets in the industry.

Some outlets have described this as Duelbits being hacked again, which shows why security track record should be part of every casino review.

Withdraw winnings regularly instead of leaving a large balance on any single site. Casinos with instant withdrawals such as Betplay.io and BC.Game make it easy to move funds back to a wallet you control.

Spread your bankroll across more than one trusted operator, enable two-factor authentication, and always use a self-custody wallet for long-term holdings. Check the operator's official channels, not social media replies, for updates during any outage, and ignore anyone offering to recover funds for a fee.

Finally, prefer casinos that publish provably fair results and have a clear record of handling incidents. Our Best Crypto Casinos 2026 ranking weighs payout speed and trust signals for exactly this reason.