Duelbits (hot wallets, September 2026) hack — September 2026

Duelbits, a crypto casino and sports-betting site licensed in Curacao, lost about $7m from its hot wallets on 24 September 2026. The blockchain security firm Scam Sniffer first flagged the incident, reporting that Duelbits hot wallets on Ethereum, BNB Chain and Tron had sent funds to newly created addresses in a suspected private-key compromise, and later said the bitcoin hot wallet had also lost 8.1 BTC. A co-founder confirmed a hack of about $7m on X, said the team was still investigating exactly what happened and how, and said user funds were safe.

Etherscan data reviewed by CoinDesk shows the Ethereum hot wallet sending 836 ETH, about 593,000 USDT, 97,000 USDC, 31,500 DAI and 12.4 billion SHIB to the attacker within minutes, leaving it with less than $25 in ether. Crypto Briefing lists 1.62 million USDT, 209 BNB and 192,000 TRX across the chains, with smaller outflows on Bitcoin and Solana. Most of the stolen assets were swapped to ether and consolidated into a single new address holding about 2,234 ETH, roughly $6m, which had not moved onward when CoinDesk reported. Early tallies of about $4.2m to $4.9m, taken before the Bitcoin and Solana outflows were counted, were superseded by the co-founder's figure, which is the one recorded here.

The site went offline while the team investigated and rebuilt its deposit and withdrawal servers. On 25 September the co-founder posted three wallets to be used to restock the hot wallets; FairGambling checked them the next day and found 2,000 ETH, 5,704 SOL, 128 BNB and $1.5m in stablecoins. Duelbits reopened on 27 September with deposits and withdrawals live, saying it had relaunched with about $8m across hot and cold wallets. It has said throughout that user balances were not affected and the loss fell on the operator's own funds, so the outcome is recorded as users reimbursed. It has still not published a root cause, so the private-key vector remains Scam Sniffer's assessment rather than a confirmed finding, and no freeze or recovery of the stolen funds has been reported. This is the second entry for Duelbits in this registry: a hot-wallet theft of about $4.6m in February 2024 is recorded separately.