Gamdom suffers breach and loses more than $3M after transfers across five blockchains

Gamdom confirmed a security breach that caused losses exceeding $3 million and forced the gaming platform to go temporarily offline. The incident concentrated on 13 October when Gamdom's hot wallets on Ethereum, Solana, BNB Chain, Tron and the XRP Ledger executed suspicious transfers exceeding $2.3 million to five addresses in roughly one hour.

## Gamdom security breach: what happened on 13 October

On 13 October Gamdom's three Ethereum hot wallets moved about $1.2 million to an address that immediately converted balances in USDT and USDC to DAI. Another Ethereum wallet received $870,000 in DAI, largely via the Relay bridge. Together, in a later phase two of the addresses held roughly $1.8 million in DAI and 87 ether.

The transfers totalling more than $2.3 million originated from active hot wallets across five chains: Ethereum, Solana, BNB Chain, Tron and the XRP Ledger. At least four of the receiving addresses had not been used previously, according to transaction tracing. A small ether movement linked back to an old Gamdom wallet, and one recipient address received approximately $10,000 in BUSD, likely the next operation tied to BNB Chain activity.

## How the transfers affected operations

On‑chain activity forced Gamdom to take services offline shortly after the outflows. Initially the company posted on X that it would return shortly, but did not immediately explain the full nature of the outage. On 14 October Gamdom reported it had detected an unauthorized connection to one of its servers following a possible disk failure; as a result it took systems offline and said user data remained safe.

Owner Felix Romer later confirmed the incident resulted in losses of more than $3 million. Gamdom said the platform would resume activity within hours, without specifying in that statement the exact technical steps or recovery measures to be applied before reopening.

## Technical analysis of the on‑chain asset movements

The transaction pattern shows two clear dynamics: rapid conversions between stablecoins and use of bridges to move liquidity across chains. On Ethereum there were conversions from USDT and USDC to DAI immediately after receiving funds; part of the flow arrived via the Relay bridge, which facilitated moving assets to the address that accumulated DAI.

Records also show activity on BNB Chain and a receipt in BUSD for an amount near $10,000, suggesting attackers used multiple routes and protocols to fragment funds. At least four recipient addresses were brand new, complicating initial traceability and indicating the creation of new addresses to launder or consolidate funds.

## Operational impact and Gamdom's public messages

Gamdom issued direct public communications within 24–48 hours. The operator said personal user information remained secure after the technical intervention and that it had detected an unauthorized connection linked to a possible disk failure on one of its servers. The company's message prioritized containment and data integrity but did not provide a public breakdown of technical remediations or fund recovery routes.

The shutdown and the promise to return in "a few hours" indicate an attempt to restore services quickly while investigators determined the exact scale of the economic diversion. Owner Felix Romer confirmed total losses above $3 million, a figure that includes the movements traced across the five chains cited.

## What operators and vendors should consider after this breach

The attack sequence highlights exposure from multichain hot wallets and the need for stricter controls on server access and key management. For infrastructure providers and platforms, points of attention include:

• segregation and hardening of access to servers that manage hot wallets;

• real‑time monitoring of outbound flows across multiple chains;

• contingency procedures that include orderly disconnection and user communications.

For operators integrating liquidity across blockchains, the incident underlines the importance of on‑chain forensic audits and contingency plans that contemplate migration or freezing of assets when atypical movement is detected.

## Condensed timeline

1. 13 October: hot wallets on Ethereum, Solana, BNB Chain, Tron and the XRP Ledger transfer more than $2.3 million to five addresses in ~1 hour.

2. Immediate: multiple conversions from USDT/USDC to DAI and use of the Relay bridge; at least four recipient addresses were new.

3. Shortly after: Gamdom disconnects the platform and posts a message on X announcing a temporary outage.

4. 14 October: Gamdom reports an unauthorized connection linked to a possible disk failure; confirms user data are secure.

5. Subsequent: Felix Romer confirms losses over $3 million and the intention to resume operations within hours.

For readers interested in product operation and user experience, Gamdom is a gaming platform that uses multiple blockchains to manage assets and payments; how it restores services and recovers or preserves forensic evidence will determine medium‑term impact on users and vendors.

The platform and infrastructure integrators will need to review procedures and contracts with custodians and security teams. Coverage of the incident will be relevant to the operator and vendor community in our sections of news [news](/news) and for technology partners in b2b [b2b](/b2b).