Crypto gambling platform Duelbits took its site offline on 24th September, 2026 after attackers drained roughly $7 million from its hot wallets in a suspected private key compromise.
The Brief
- Duelbits co-founder Joe confirmed the hack on X and said user funds are safe while the platform stays offline.
- Scam Sniffer, a blockchain security firm, flagged hot wallet outflows on Ethereum, BNB Chain, Tron and Bitcoin.
- The attacker swapped most of the stolen tokens to ether and parked about 2,234 ETH, worth roughly $6 million, in one address.
- Duelbits says the site will stay dark until its investigation ends and its hot wallets are refilled.
Duelbits hot wallets drained on four chains
Joe, who posts on X as @DuelbitsJoe, confirmed the loss in a short post. “Confirming a ~$7M hack. Still investigating exactly what happened and how,” he wrote, adding that “user funds are safe.” In a separate statement, Duelbits described the event as a “security incident” and said it pulled the site as a precaution.
Scam Sniffer raised the alarm first. The firm said Duelbits hot wallets on Ethereum, BNB Chain and Tron sent funds to newly created addresses in a suspected private key compromise. Scam Sniffer later added that the casino’s bitcoin hot wallet lost 8.1 BTC.
Confirming a ~$7M hack. Still investigating exactly what happened and how.
— Joe (@DuelbitsJoe) September 24, 2026
Until we have clarity, Duelbits stays offline. User funds are safe.
Next steps: finish the investigation, re-top hot wallets, and bring Duelbits back online, launch Duelbits 2.0.
I'll keep posting… https://t.co/V4Zl4St31I
Etherscan data shows the Ethereum wallet tagged as a Duelbits hot wallet emptied within minutes. It sent the attacker:
- 836 ETH
- about 593,000 USDT
- 97,000 USDC
- 31,500 DAI
- 12.4 billion SHIB
That wallet now holds less than $25 in ether. The speed of the drain fits the suspected cause. A thief holding the signing key needs no contract bug, because the wallet obeys whoever signs.
The same method hit Stake, the largest crypto casino by volume, in 2023, when hackers made off with $40 million. Exchanges face the identical exposure, as Turkish platform BtcTurk found during its $48 million hot wallet breach in August 2025.
The stolen funds now sit in one address
Most of the stolen assets have since been swapped to ether. The attacker consolidated them into a single new address holding about 2,234 ETH, worth roughly $6 million. Etherscan data reviewed by CoinLaw shows the ether arrived in a handful of large deposits, including transfers of 500 ETH and 501.17 ETH. The only outgoing transfer so far is a 0.1 ETH payment back to the wallet that first funded the address.
The conversion looks deliberate. Tether and Circle can freeze any addresses that hold USDT and USDC, while ether has no central issuer able to freeze a balance. By swapping those stablecoins for ETH, the attacker took away the quickest recovery tool open to Duelbits.
Before the incident, DappRadar ranked Duelbits 17th of 43 tracked crypto casinos by on-chain deposits, with about $5.7 million across its monitored wallets. That tracked total sits below the reported loss. One explanation is coverage, since DappRadar’s figures may not include every Duelbits wallet. It also isn’t clear whether they reflect balances before or after the outflows.
Several gaps remain open. Duelbits hasn’t said how the key was exposed or whether player deposits sat in the drained wallets. It also hasn’t broken out the BNB Chain and Tron losses or given a reopening date for the casino. Nor has it said whether it asked exchanges to flag the attacker’s address.
What Happens Now?
Players with balances can’t reach them through the site while it’s down. Anyone with funds there should treat unsolicited “refund” or “claim” links tied to the outage with suspicion. Fake recovery pages are a familiar wallet drainer tactic, so updates are safest checked through Duelbits’ official channels only.
The timeline now rests on two markers. Duelbits reopens only after its investigation closes and its hot wallets are refilled, and the consolidation address offers the clearest trail. Any transfer to a bridge or an exchange deposit address would be the first real signal of where the money is headed.
