Crypto casino Duelbits has taken its site offline after attackers siphoned approximately $7 million from its various wallets across four blockchain networks.
Security research firm Scam Sniffer first detected unusual transfers from Duelbits wallets on BNB Chain, Ethereum, and Tron, followed by the detection of 8.1 BTC stolen from the casino's Bitcoin wallet. Duelbits co-founder Joe confirmed the incident, stating the company was investigating and would remain offline until the investigation concluded and hot wallets were replenished.
Compromised Hot Wallets
The affected wallets were hot wallets—online accounts holding cryptocurrency for processing customer deposits and withdrawals. While convenient for transaction speed, hot wallets carry increased risk if credentials are compromised.
Attackers obtained 836 ETH, approximately 593,000 USDT, 97,000 USDC, 31,500 DAI, and 12.4 billion SHIB. Scam Sniffer suspects a private key was compromised, given the speed and scale of the withdrawals, though Duelbits has not confirmed this explanation.
Funds Consolidated in Ether
Most stolen tokens were exchanged for Ether and consolidated into a single address holding approximately 2,234 ETH, valued at roughly $6 million at the time of detection. The funds had not moved further at the time they were traced.
The conversion to Ether complicates potential recovery. Stablecoin issuers can freeze USDT and USDC assets in cases of theft, but no such mechanism exists for Ether, which has no central issuer capable of freezing funds.
Outstanding Questions
Duelbits has not disclosed how wallet credentials were breached, whether customer deposits were held in affected wallets, or when withdrawals will resume. The company stated that funds within customer accounts remain unaffected.
Users have been advised to avoid refund or recovery links shared during the outage, as many such links are designed to capture wallet details and recovery phrases.
