Duelbits takes its casino offline after approximately $7 million escape from hot wallets

Duelbits took its website offline on September 24, 2026, after detecting a security breach that resulted in approximately $7 million escaping from hot wallets controlled by the company. The movements initially affected Ethereum, BNB Chain, and Tron networks; further investigators identified an additional loss of 8.1 BTC from a Bitcoin hot wallet. Co-founder Joe publicly confirmed the incident, stating that “user funds are safe.”

Duelbits security breach: what we know about the theft and affected chains

On-chain records and security analysis pointed to unusual transfers from addresses linked to Duelbits to newly created wallets. The following networks were involved in the early phases of the attack: Ethereum, BNB Chain, and Tron. It was later detected that Duelbits' Bitcoin wallet suffered a theft of 8.1 BTC, increasing the number of affected blockchains to four.

The movements in the Ethereum-associated address included 836 ETH, approximately 593,000 USDT, 97,000 USDC, 31,500 DAI, and 12.4 billion SHIB. Following the transfers, the identified Ethereum address as Duelbits' hot wallet was left with less than $25 in ether.

How hot wallets operate and the hypothesis of private key control

Hot wallets are connected to online systems to process transactions quickly. That accessibility means whoever gains the credentials or private keys can sign transfers. Analysts from Scam Sniffer observed the speed and size of the movements and pointed to the possibility of a private key compromise; Duelbits has not confirmed that assessment.

After the theft, most of the stolen tokens were exchanged for ether and consolidated in a newly created Ethereum address that came to contain nearly 2,234 ETH — an amount valued at around $6 million at the time of tracking the transactions. At the time of reporting, those funds had not moved from that address.

“Confirming a ~$7M hack. Still investigating exactly what happened and how,” wrote Joe, co-founder of Duelbits, adding that “user funds are safe.”

Impact on user deposits and service status

Duelbits has kept the platform inaccessible while completing its investigation and replenishing the affected hot wallets. The company has not detailed whether customer deposits were stored in the compromised wallets or set a reopening date. The firm stated it will resume operations once the investigation is completed and the hot wallet balances are restored.

Prior to the incident, DappRadar ranked Duelbits 17th among 43 monitored crypto casinos by on-chain deposits; the monitored wallets showed approximately $5.7 million, although it was not clarified whether that figure corresponded to balances before or after the unauthorized transfers.

Conversion of stablecoins and limitations for recovering assets

The conversion of stablecoins to ether complicates the options for containing stolen assets. Centralized stablecoin issuers, such as USDT and USDC, have mechanisms to freeze tokens under certain circumstances; ether lacks a central issuer with a similar capacity to immobilize funds in a direction. This reduces the available tools to halt the consolidation of funds once they change to ETH.

Secondary risks: fraudulent recovery attempts and user advice

The service outage has created a market for unofficial “recovery” offers. Duelbits warned its user base to avoid pages and links requesting wallet credentials or recovery phrases. During the downtime, users may encounter scams promising refunds if they provide private keys; supplying that information definitively compromises any chance of recovery.

Comparable backgrounds and sector context

A similar attack was linked to the incident against the crypto casino Stake in 2023, when attackers took approximately $40 million. The comparison does not establish an identical cause, but shows that compromises of hot wallets have been a recurrent vein in attacks on crypto operators.

Next steps declared by Duelbits and considerations for operators and providers

Duelbits has described the event as a "security incident" and indicated that it plans to restore operations and launch a version called Duelbits 2.0 once the investigation concludes and the hot funds are replenished. The company has not published a technical report or a detailed timeline of forensic actions.

For cryptocurrency operators and payment infrastructure providers, the episode underscores the need for stricter controls in key management and strategies that minimize hot wallet exposure, as well as the utility of external audits and custody solutions that separate operational capabilities from asset ownership.

What remains unclear

It remains unanswered how the attacker gained access to the wallets and what portion, if any, of the user balance was stored in those hot addresses. Duelbits has also not published independent evidence confirming that client funds are safe. The reopening will depend on the company's internal investigation and the replenishment of the hot wallets.

For updates on regulation and security in the crypto and casino space, these issues will continue to be monitored by analysts and on-chain tracking services like Scam Sniffer and DappRadar. You can review related developments in our regulation section and in the news coverage.

Gonzalo Marín, Sector Operations Correspondent.