Duelbits Confirms $7M Hot-Wallet Hack
Duelbits has confirmed a hack that cost the crypto casino about $7 million. The platform took its site offline while it investigates the incident and prepares to refill its hot wallets.
Duelbits co-founder Joe confirmed the loss on X on September 24. He said the exact cause was still being investigated and that user funds were safe.
The company plans to complete the investigation and replenish the affected hot wallets before restoring operations. A launch of Duelbits 2.0 is also listed among its next steps.
Earlier estimates were lower because blockchain researchers were still identifying the affected wallets.
Four Networks Showed the First $4.9M
Security researchers initially picked up about $4.2 million leaving Duelbits wallets on Ethereum, BNB Chain and Tron. The assets included 836 ETH, 1.62 million USDT, 97,000 USDC, 209 BNB and 192,000 TRX.
An additional 8.1 BTC was later traced from a Duelbits Bitcoin hot wallet. That pushed the tracked amount to roughly $4.9 million.
SlowMist records the incident as a suspected private-key compromise and lists Ethereum, BNB Chain, Tron and Bitcoin among the affected networks. Duelbits has not yet published its own explanation of how access to the wallets was obtained.
Most of the assets were converted into ether after leaving the casino wallets. The proceeds were then gathered in one Ethereum address.
That address received about 2,234 ETH, worth around $6 million when the transactions were reviewed. The figure was already well above the first on-chain estimate, although it still fell short of Duelbits’ own $7 million total.
Second Hot-Wallet Breach in 31 Months
This is not the first time Duelbits has lost funds from an operational crypto wallet. In February 2024, the casino suffered another hot-wallet breach. Cybersecurity company Halborn put that loss at $4.6 million.
Using Duelbits’ current estimate, the latest incident is about $2.4 million larger, or roughly 52% above the 2024 loss. Together, the two reported breaches amount to approximately $11.6 million.
There is another connection between the incidents. The Ethereum address used by Duelbits before this week’s attack appeared after the 2024 breach and remained in use until the latest incident.
The Cause Is Still Unknown
Duelbits has not given a timetable for a full technical report. Its immediate plan is to finish the investigation, restore the hot-wallet balances and bring the platform back online.
What matters now is the cause. One stolen key is one problem, but a wider failure in wallet controls is another.