Gamdom lost $3 million after hot-wallet breach across five blockchains

Gamdom confirmed a security breach that led to losses of just over $3 million, after suspicious transfers emptied its hot wallets across five blockchains on 13 October 2026. The gambling platform went offline shortly after the transfers and initially posted on X that it would return soon; owner Felix Romer later confirmed the monetary loss and said systems had been taken offline for investigation.

What happened on 13 October — the on-chain trace

On 13 October Gamdom’s hot wallets on Ethereum, Solana, BNB Chain, Tron and the XRP Ledger moved funds in a concentrated sequence that lasted roughly an hour. Those transfers totalled more than $2.3 million sent to five recipient wallets within that window. At least four of those recipient wallets had not been used before the incident.

Three Ethereum wallets tied to Gamdom moved around $1.2 million into a wallet that immediately converted USDT and USDC to DAI. A separate Ethereum wallet received approximately $870,000 worth of DAI, with most of that amount routed via the Relay bridge. At a later stage the two destination wallets together held about $1.8 million in DAI and 87 ether.

Investigators also traced a small ether transaction back to an older Gamdom wallet. The same older wallet was associated with a receiving address that took approximately $10,000 in BUSD, a transaction that appears to have been the next on-chain move related to funds that were routed via BNB Chain.

How Gamdom reacted and what the company said

Gamdom took its services offline shortly after the anomalous transfers and initially communicated the outage on X without further explanation. On 14 October Gamdom reported that an unauthorized connection had been established to one of its servers after what the company described as a possible disk malfunction. The operator said it had taken systems offline and that user data were safe.

Owner Felix Romer later provided the consolidated financial impact, confirming losses exceeded $3 million. Gamdom also stated it planned to resume operations "in a few hours" after taking the systems down for incident response.

Chain-level mechanics and the movement of stablecoins

The on-chain pattern shows two distinct behaviours: rapid consolidation of stablecoins and cross-chain routing.

• Stablecoin conversions: one destination wallet converted USDT and USDC to DAI almost immediately after receiving funds from Gamdom-linked Ethereum addresses.

• Cross-chain flow: a large portion of the $870,000 received by a separate Ethereum wallet arrived via the Relay bridge, indicating use of a bridging mechanism to move value between ecosystems.

The consolidated holdings observed later — roughly $1.8 million in DAI and 87 ether — represent the majority of the funds traced from the initial hourly outflow.

Operational implications for crypto casinos and wallets

The incident highlights the exposure crypto casinos face when hot wallets are compromised. Gamdom’s fast detection and decision to take systems offline limited the public-facing impact, but the attacker still managed to extract multi-chain liquidity quickly.

Platform operators should review hot-wallet practices, server access controls and backup disk integrity. Suppliers of custody and key-management tools will be in demand from operators seeking to minimise the attack surface that led to rapid multi-chain value extraction.

Timeline and outstanding questions

• 13 October: more than $2.3 million moved from Gamdom hot wallets on Ethereum, Solana, BNB Chain, Tron and the XRP Ledger to five recipient wallets in roughly an hour.

• Shortly after: Gamdom went offline and posted on X that it would return soon.

• 14 October: Gamdom said an unauthorized connection occurred to a server after a possible disk malfunction; it asserted user data remained safe.

• 14 October: owner Felix Romer confirmed the incident resulted in losses in excess of $3 million and said operations would resume in a few hours.

Open questions remain about the initial access vector, the role (if any) of third-party services used to sign or move funds, and whether any portion of the stolen assets has been recovered. The company’s acknowledgement that a server-level connection was involved narrows the immediate focus to operational security and server integrity rather than purely on-chain private-key compromise.

What operators and vendors should watch next

External observers and counterparties will monitor any movement of the DAI and ether that the destination wallets still hold. Regulators and payment partners may also ask for a detailed incident report given the cross-border and multi-asset nature of the loss. For operators reviewing this case, the practical actions are clear: strengthen server access logging, tighten hot-wallet transaction limits, and consider moving non-essential liquidity to cold storage.

The incident will also reverberate in conversations on platforms that host or white-label gambling services; those arrangements leave obligations on licence holders to show they manage custody and operational risk. For coverage of industry responses to incidents like this see the news section.