Duelbits (hot wallets, September 2026) hack — September 2026
Incident facts
| Date of incident | |
|---|---|
| Target type | Gaming or metaverse |
| Loss | $7,000,000Price at time of incident |
| Method | Private key compromiseHot wallets on several chains sent their balances to newly created addresses within minutes, which Scam Sniffer assessed as a private-key compromise; Duelbits has not published a root cause |
| Chains | Multiple chains, Ethereum, BNB Chain, Tron, Bitcoin |
| Outcome | Unresolved |
What happened
Duelbits, a crypto casino and sports-betting site licensed in Curacao, lost about $7m from its hot wallets on 24 September 2026. The blockchain security firm Scam Sniffer first flagged the incident, reporting that Duelbits hot wallets on Ethereum, BNB Chain and Tron had sent funds to newly created addresses in a suspected private-key compromise, and later said the bitcoin hot wallet had also lost 8.1 BTC. A co-founder confirmed a hack of about $7m on X, said the team was still investigating exactly what happened and how, and said user funds were safe.
Etherscan data reviewed by CoinDesk shows the Ethereum hot wallet sending 836 ETH, about 593,000 USDT, 97,000 USDC, 31,500 DAI and 12.4 billion SHIB to the attacker within minutes, leaving it with less than $25 in ether. Crypto Briefing lists 1.62 million USDT, 209 BNB and 192,000 TRX across the chains, with smaller outflows on Bitcoin and Solana. Most of the stolen assets were swapped to ether and consolidated into a single new address holding about 2,234 ETH, roughly $6m, which had not moved onward when CoinDesk reported. Early tallies of about $4.2m to $4.9m, taken before the Bitcoin and Solana outflows were counted, were superseded by the co-founder's figure, which is the one recorded here.
The site went offline until the investigation is finished and the hot wallets are refilled, and Duelbits said it was rebuilding its deposit and withdrawal servers. It has not published a root cause, so the private-key vector is Scam Sniffer's assessment rather than a confirmed finding. This is the second entry for Duelbits in this registry: a hot-wallet theft of about $4.6m in February 2024 is recorded separately.
Sources
- CoinDeskSecondary · retrieved 2026-09-25
- Crypto BriefingSecondary · retrieved 2026-09-25
- Bitcoin.com NewsSecondary · retrieved 2026-09-25
Changes to this entry
- Recorded the day after the incident at the roughly $7m confirmed by a Duelbits co-founder. Provisional: Duelbits has promised an official statement, and the root cause and final figure are not yet published.
Cite this
This data is published under CC BY 4.0. You may reuse it, including commercially, as long as you credit iTokenly and link back.
iTokenly Hack Registry, "Duelbits (hot wallets, September 2026) hack — September 2026", iTokenly, accessed 2026-09-25, https://itokenly.com/hacks/duelbits-september-2026https://itokenly.com/hacks/duelbits-september-2026Permalinks never change. If an entry is renamed, the old address keeps working.
Spotted an error? Write to [email protected]. Corrections to published figures are logged on this page. See the methodology for how entries are checked.