Duelbits Takes Site Offline After Roughly $7 Million Hot Wallet Hack

What to Know

• Duelbits confirmed a roughly $7 million hack and took its crypto gambling platform offline while it investigates the incident.
• The platform said user funds are safe and that operations will remain offline until the investigation is complete and hot wallets are refilled.
• Blockchain security firm Scam Sniffer flagged suspicious outflows from Duelbits hot wallets on Ethereum, BNB Chain, Tron and Bitcoin.
• The incident is being treated as a suspected private key compromise, a type of breach that can allow attackers to move funds directly from affected wallets.
• The company’s bitcoin hot wallet reportedly lost 8.1 BTC.
• Etherscan data shows a Duelbits-labeled Ethereum hot wallet sent 836 ETH, about 593,000 USDT, 97,000 USDC, 31,500 DAI and 12.4 billion SHIB to the attacker within minutes.
• The Ethereum hot wallet now holds less than $25 in ether.
• Most of the stolen assets were swapped to ether and consolidated into a single new address holding about 2,234 ETH, worth roughly $6 million.
• The consolidated funds had not moved onward as of publication.
• Before the incident, DappRadar ranked Duelbits 17th of 43 tracked crypto casinos by on-chain deposits, with about $5.7 million across monitored wallets, though it was not immediately clear whether those figures reflected balances before or after the outflows.

Duelbits Goes Offline After Hot Wallet Drain

Duelbits, a crypto gambling platform, has taken its site offline after attackers drained roughly $7 million from its hot wallets. The shutdown came as the company began investigating what it described as a security incident, with the platform saying the move was precautionary while teams work through the cause and scope of the breach.

The confirmation came after suspicious blockchain movements were identified across multiple networks. The incident affected hot wallets linked to Ethereum, BNB Chain, Tron and Bitcoin, broadening the impact beyond a single blockchain environment. Hot wallets are used for active platform operations because they remain connected enough to process deposits, withdrawals or other user-facing activity. That convenience also makes them a prime target when a signing key, wallet control system or operational security layer is compromised.

Duelbits said user funds are safe, while also indicating that the platform will remain offline until the investigation is completed and its hot wallets are refilled. That statement is important for users because a hot wallet loss does not automatically mean customer balances have been impaired. Many crypto platforms separate operational liquidity from broader liabilities, although users typically wait for clearer updates before regaining full confidence in withdrawals and platform activity.

Suspected Private Key Compromise Draws Scrutiny

Scam Sniffer first flagged the outflows and pointed to a suspected private key compromise. In crypto infrastructure, a private key is the critical credential that authorizes blockchain transactions. If an attacker gains access to a key controlling a wallet, they may be able to send assets out without needing to exploit a smart contract bug or bypass a conventional login system.

That suspected attack path matters because blockchain transactions are generally irreversible once confirmed. When a hot wallet key is compromised, defenders often have very limited time to respond. The typical emergency response is to pause platform services, revoke or rotate credentials where possible, move remaining assets to safer wallets and coordinate with security firms, exchanges and analytics teams to trace stolen funds.

The incident also recalls the attack method used against Stake, the largest crypto casino by volume, in 2023. In that case, hackers made off with $40 million. The comparison does not establish that the same attackers were involved, but it underscores why crypto gambling platforms remain high-value targets. These businesses often manage substantial on-chain liquidity and must support fast movements of crypto assets, creating operational demands that differ from fully cold-storage custody models.

Ethereum Wallet Movements Show Rapid Draining

Etherscan data showed the Ethereum wallet labeled as a Duelbits hot wallet sent 836 ETH, about 593,000 USDT, 97,000 USDC, 31,500 DAI and 12.4 billion SHIB to the attacker within minutes. The speed and range of assets involved suggest that the attacker was able to move multiple token balances in quick succession once wallet control was obtained or transaction authorization became possible.

The same wallet now holds less than $25 in ether, illustrating how thoroughly the accessible balance was drained. In many crypto incidents, attackers prioritize liquid and widely traded assets first, because these can be swapped, bridged or consolidated more easily than smaller or less active tokens. In this case, most of the stolen assets were later swapped to ether, a common consolidation choice because ether is one of the most liquid assets in the crypto market and can be tracked clearly on Ethereum.

Most of the stolen value has been consolidated into a single new address holding about 2,234 ETH, worth roughly $6 million. The funds had not moved onward as of publication. That lack of onward movement may give investigators and blockchain surveillance teams a window to continue monitoring the wallet, flag related addresses and alert centralized venues that may be used in any attempted cash-out. However, the fact that funds are visible on-chain does not guarantee recovery.

Bitcoin, Tron and BNB Chain Expand the Scope

The breach was not limited to the Ethereum wallet. Scam Sniffer said Duelbits hot wallets on BNB Chain and Tron also sent funds to newly created addresses, and later said the company’s bitcoin hot wallet lost 8.1 BTC. The presence of multiple affected chains is one reason market participants are focusing on a possible key or operational compromise rather than a narrow exploit tied to one blockchain protocol.

Multi-chain hot wallet infrastructure can be complex. Platforms that support several networks must manage different wallet formats, signing environments and operational procedures. If a common internal process or credential management layer is compromised, attackers may be able to reach more than one network. That is why incident response teams often move quickly to freeze front-end activity, investigate all connected systems and avoid reopening until they are confident that remaining funds cannot be accessed by the same attacker.

Tron and BNB Chain are commonly used in crypto payment flows because users often seek lower fees and fast transfers, while Ethereum remains central for high-liquidity assets and stablecoin movement. Bitcoin adds another layer because its wallet structure and transaction model differ from account-based networks. The cross-chain nature of the Duelbits incident therefore raises operational questions that investigators will need to answer before the platform can return to normal service.

User Funds and Platform Operations Remain in Focus

Duelbits has said user funds are safe, a statement likely aimed at limiting panic among customers who may be unable to access the site while it is offline. The platform also said it will remain offline until its investigation is finished and hot wallets are refilled. For a gambling platform, hot wallet liquidity is central to user withdrawals and game-related settlement activity, so refilling those wallets is a practical step before services can resume.

Still, users generally look for more than a broad assurance after a hack. They often want clarity on whether withdrawals will resume, whether balances will be affected, whether any personal account controls were involved and whether the incident was limited to operational wallets. Duelbits has described the matter as a security incident and taken the site offline as a precaution, but the full technical explanation remains under investigation.

Until more details are available, the main confirmed facts are the approximate value drained, the networks involved, the specific Ethereum outflows visible on-chain, the reported bitcoin hot wallet loss and the consolidation of most stolen assets into ether. Those details provide a clearer view of what happened on-chain, while leaving open the more important question of how the attacker obtained the ability to move funds.

DappRadar Ranking Highlights Duelbits’ Market Footprint

Before the incident, DappRadar ranked Duelbits 17th of 43 tracked crypto casinos by on-chain deposits, with about $5.7 million across its monitored wallets. It was not immediately clear whether those figures reflected balances before or after the outflows. Even with that uncertainty, the ranking indicates that Duelbits was a visible player in the tracked crypto casino segment rather than a small or obscure operation.

Crypto casinos occupy a distinctive corner of the digital asset market. They rely on blockchain rails for deposits and withdrawals, often support multiple tokens and chains, and face both cybersecurity and compliance pressures. Their wallets can become attractive targets because attackers may assume that platforms need to keep enough liquidity online to process frequent user activity.

The Duelbits incident may therefore add pressure on similar platforms to review hot wallet limits, signing controls and incident response procedures. Security specialists often recommend minimizing hot wallet exposure, using multi-signature controls where feasible, segregating assets across operational layers and maintaining strong monitoring for unexpected transfers. Those are general industry practices, but each platform’s architecture determines how effective they are in practice.

Why Consolidation Into Ether Matters

The attacker’s decision to swap most stolen assets into ether and consolidate them into one address is significant because it simplifies tracking while also creating flexibility for later movement. A single large ether balance can be monitored by security researchers, exchanges and analytics teams. At the same time, the holder may choose later to split funds into smaller amounts, attempt bridging, interact with mixing tools or seek off-ramp routes through less compliant venues.

For now, the consolidated address holding about 2,234 ETH, worth roughly $6 million, had not moved onward. That static position does not necessarily mean the attacker is finished. In many cases, stolen funds remain idle while attackers wait for attention to fade or while they assess whether addresses have been flagged. Investigators, meanwhile, use that time to map transaction flows and coordinate alerts.

Because crypto transactions are public on many chains, the movement of stolen funds can be watched in near real time. That transparency is one of the reasons hacks are often identified quickly. It is also why attackers frequently move funds through layers of swaps and wallets. Whether any of the stolen Duelbits assets can be frozen, recovered or otherwise contained will depend on where the funds move next and whether they touch services able and willing to intervene.

Frequently Asked Questions (FAQs)

What happened to Duelbits?

Duelbits took its crypto gambling platform offline after attackers drained roughly $7 million from its hot wallets. The company said it is investigating the incident and has described the site shutdown as a precaution.

Did Duelbits say user funds are safe?

Yes. Duelbits said user funds are safe and indicated that the platform will stay offline until the investigation is complete and its hot wallets are refilled.

Which blockchains were affected in the Duelbits hack?

Suspicious outflows were flagged from Duelbits hot wallets on Ethereum, BNB Chain, Tron and Bitcoin. Scam Sniffer said the company’s bitcoin hot wallet also lost 8.1 BTC.

How much crypto was stolen from the Ethereum hot wallet?

Etherscan data shows the Duelbits-labeled Ethereum hot wallet sent 836 ETH, about 593,000 USDT, 97,000 USDC, 31,500 DAI and 12.4 billion SHIB to the attacker within minutes.

Where are most of the stolen funds now?

Most of the stolen assets were swapped to ether and consolidated into a single new address holding about 2,234 ETH, worth roughly $6 million. The funds had not moved onward as of publication.

What is a suspected private key compromise?

A suspected private key compromise means attackers may have obtained the cryptographic credential needed to authorize wallet transactions. If that happens, funds in the affected wallet can be moved directly on-chain.

Why did Duelbits go offline?

Duelbits went offline while investigating the security incident and said the platform would remain offline until the investigation is finished and hot wallets are refilled.

How does this compare with the Stake hack?

The suspected method is similar to the type of private key compromise that targeted Stake in 2023, when hackers made off with $40 million. That comparison highlights a broader risk for crypto gambling platforms that manage active hot wallet liquidity.

Was Duelbits a major crypto casino?

Before the incident, DappRadar ranked Duelbits 17th of 43 tracked crypto casinos by on-chain deposits, with about $5.7 million across monitored wallets. It was not immediately clear whether those figures reflected balances before or after the outflows.