Duelbits Goes Offline After ~$7M Hot Wallet Breach Across Four Blockchains

Duelbits took its casino platform offline on 24 September 2026 after a security breach that saw roughly $7 million removed from hot wallets the company controlled across multiple blockchains. Investigators tied the initial transfers to wallets on Ethereum, BNB Chain and Tron, then found an additional loss of 8.1 BTC from a Bitcoin hot wallet; Duelbits co-founder Joe confirmed the incident publicly and said user funds are safe while the firm investigates.

Duelbits hack: what moved and where

Blockchain transaction records show large, rapid transfers from addresses researchers identified as Duelbits hot wallets. The Ethereum-linked activity included 836 ETH, approximately 593,000 USDT, 97,000 USDC, 31,500 DAI and 12.4 billion SHIB. After those outgoing transfers the Ethereum address tied to Duelbits held less than $25 worth of ether.

Scam Sniffer, a blockchain security research group, flagged the unusual flows and suggested the speed and scale were consistent with a private key compromise. Duelbits has not publicly confirmed the private key theory. Investigators later identified the Bitcoin loss of 8.1 BTC, expanding the incident to a fourth blockchain.

"Confirming a ~$7M hack. Still investigating exactly what happened and how," wrote Duelbits co-founder Joe, who also stated that "user funds are safe."

Most of the stolen tokens were converted into ether and consolidated into a single newly created Ethereum address holding about 2,234 ETH, valued at roughly $6 million at the time analysts reviewed the chain. Those funds had not moved on further when they were reported.

Hot wallet mechanics and the suspected attack vector

Hot wallets are custodial addresses kept online to enable fast withdrawals and deposits. That accessibility improves transaction speed but also increases exposure: anyone who gains the credentials or private key controlling a hot wallet can sign transfers directly.

Scam Sniffer’s assessment rests on the pattern and speed of the transfers. A similar method was used in the 2023 Stake attack, when hackers removed roughly $40 million after compromising an online wallet. Duelbits has not provided technical details that confirm whether the attacker obtained private keys, credentials, or exploited another vulnerability.

Balances, rankings and what was at risk

Before the breach, DappRadar ranked Duelbits 17th among 43 crypto casinos it tracked by on-chain deposits. The monitored wallets were recorded as containing about $5.7 million, although reports did not clarify whether that number reflected balances before or after the unauthorised transfers. Duelbits has not disclosed which customer deposits — if any — had been held in the affected hot wallets at the time of the breach.

Centralised stablecoin issuers can sometimes intervene to freeze tokens. The conversion of stolen USDT and USDC into ether reduced the options available to block or freeze the consolidated funds because Ether has no central issuer with equivalent freezing power.

Duelbits response and platform status

Duelbits took the site offline as a precaution and said it would remain unavailable until the internal investigation finishes and the affected hot wallets are replenished. The company has not given a timeline for reopening or a detailed post-incident forensic report.

The organisation cautioned users about fraud and fake recovery offers circulating while the platform is down. Customers were warned not to follow unofficial refund or recovery links that request wallet credentials or seed phrases.

Co-founder Joe communicated that the company intends to restore Duelbits operations and later launch Duelbits 2.0, but he did not set dates for either action.

Industry context and implications for operators

The Duelbits incident underscores the exposure online custody creates for crypto-first operators. Security failures at hot wallets have previously resulted in large losses; the Stake attack in 2023 is a clear precedent. For operators and platform vendors, the incident reinforces two practical priorities:

1. Isolating customer funds in cold storage where operationally feasible.

2. Tightening controls around private key management, multi-signature custody and withdrawal approval flows.

For customers, the immediate practical risks are lost funds and targeted phishing attempts while a legitimate service is unavailable. For regulators and payment partners, the episode will prompt renewed attention to custody practices in the crypto-gambling sector.

What remains unanswered

Duelbits has preserved a limited public account of events: the company confirmed the financial scale (approximately $7m), the blockchains involved (Ethereum, BNB Chain, Tron and Bitcoin), and that it has taken the platform offline while investigating. It has not confirmed whether the breach affected user balances, whether any funds were held in cold wallets, or the exact technical mechanism that allowed the transfers.

Independent chain analysis captured the token flows and the 2,234 ETH consolidation point, but custody providers and stablecoin issuers had not reported interventions at the time of writing. The company’s plans to replenish hot wallets prior to reopening mean the platform’s return depends on both the internal investigation and rebuilding online liquidity.

Next steps to watch

Watch for a public forensic report from Duelbits, movements from the consolidated Ethereum address, and any statements from stablecoin issuers about token freezes. The company’s timeline for restoring service and launching Duelbits 2.0 will be material to users and competitors alike.