Duelbits exploit analysis

What happened

On 24 September 2026, attackers drained roughly $7 million from the hot wallets of Duelbits, a Curaçao-licensed crypto casino and sportsbook founded in 2020. The company took the site offline within hours and said it would stay offline until the breach is fully understood and the wallets are refilled (Web3 Is Going Just Great, LCB.org).

Scam Sniffer, the blockchain security firm that first detected the suspicious transactions, saw outflows from Duelbits wallets on Ethereum, BNB Chain, and Tron, and later identified a separate loss of 8.1 BTC from a Duelbits Bitcoin hot wallet. The total moved across four networks.

What was taken

The Ethereum hot wallet alone sent 836 ETH, around 593,000 USDT, 97,000 USDC, 31,500 DAI, and 12.4 billion SHIB to newly created addresses within minutes. Additional outflows included 209 BNB and 192,000 TRX. The original Ethereum wallet was left with less than $25 in ETH after the drain (LCB.org, CoinLive).

The attacker then swapped most of the stolen tokens into Ether and consolidated them in a single new address holding about 2,234 ETH, valued at roughly $6 million at the time. The funds had not moved on from that address when researchers last checked. The swap to ETH matters for recovery, because USDT and USDC issuers can freeze their tokens at the smart-contract level, while Ether has no central issuer that can do the same (LCB.org).

How it happened

Duelbits has not disclosed how its hot wallets were accessed. Scam Sniffer's working assessment, which the company has neither confirmed nor denied, is that the attack involved a compromised private key. The speed and pattern of the transfers, with multiple chains emptied within minutes and the proceeds already swapped to ETH, fit a key compromise rather than a smart-contract bug. A private key acts as the master credential for a wallet, and whoever holds it can move funds without further interaction with the blockchain itself (CoinLive, LCB.org).

The Duelbits hot wallets were always online, which is what allowed the casino to process deposits and withdrawals in real time. Always-on wallets are also the most exposed entry point on a centralised platform, since any compromise of the key material lets the attacker empty them in one pass.

The response

Duelbits co-founder Joe confirmed the incident on X within hours, writing "Confirming a ~$7M hack. Still investigating exactly what happened and how," and said user balances were untouched. The company has not yet provided a timeline for restoring withdrawals, and has warned users to be cautious of links claiming to offer refunds or recovery (LCB.org).

Duelbits reopened roughly four days later with $8 million in assets staged for immediate customer payments, and announced a "Duelbits 2.0" rebuild that includes refreshing the deposit and withdrawal servers and replenishing both hot and cold wallets. The company has not yet published a detailed root-cause write-up (Ground News).

What it sits next to

The Duelbits case is the second major private-key-compromise loss at a crypto casino. Stake, the largest crypto casino by volume, took a $40 million hit in 2023 through the same method, and the playbook at Duelbits maps to that incident (Moomoo). Duelbits itself was hit before, in February 2024, when Halborn reported a $4.6 million loss from a platform vulnerability. Before this week's incident, DappRadar ranked Duelbits seventeenth of 43 tracked crypto casinos by on-chain deposits, with around $5.7 million across its monitored wallets.

The same 24 September news cycle also carried two unrelated losses: Payy Network's $1.83 million bridge drain and Meter's $2.3 million unauthorised-mint exploit. Duelbits sat on the key-compromise side of the day's spectrum. The three together made 24 September the largest single-day loss tally of 2026 to that point, with combined reported damages above $11 million.