Crypto casino Gamdom is facing a $15 million bitcoin ransom demand from the cyber-extortion group Whitearmor, which claims to have stolen records belonging to 15.4 million accounts. The demand surfaced on Oct. 26, less than two weeks after a separate hot-wallet attack cost the gambling platform more than $3 million.
Gamdom disputes the alleged database's size, and the full Whitearmor claim remains unverified.
A $15 million demand for 15.4 million accounts
Whitearmor published Gamdom's details on its extortion site, claiming access to 146 data fields per account across 15,420,003 records. The group posted a roughly 437-kilobyte JSON sample containing approximately 100 records as purported evidence.
According to the reports, the attackers allegedly exploited an aging internal machine account whose credentials had never been rotated, retaining administrative privileges long after its creation.
Gambling Lore reported that a hacker identifying as Veryso claimed to have extracted the records on Oct. 13, the same day as Gamdom's wallet breach. The outlet reportedly verified one longstanding user's record containing login timestamps, an IP address and betting information. That limited confirmation does not establish that 15.4 million accounts were compromised.
The earlier wallet breach
On Oct. 13, Gamdom suffered a separate attack targeting its operational cryptocurrency wallets. Gamdom founder Felix Römer acknowledged at the time that losses exceeded $3 million, while blockchain researcher vxdb estimated approximately $4.2 million was taken across several networks.
The platform temporarily suspended operations before returning on Oct. 16, assuring customers that their balances remained protected.
Römer initially disputed claims of widespread data extraction, suggesting attackers possessed only a few hundred accounts. Subsequent statements acknowledged possible exposure of usernames, email addresses and gambling activity, while maintaining that identity verification documents were unaffected.
Unverified claims and unresolved questions
Whitearmor's demand exceeds Gamdom's acknowledged wallet losses several times over. The group also claims the compromised accounts represent more than $1 billion in combined profit value, without explaining how that figure was calculated.
Neither the complete database nor its alleged scale has been independently verified, and no ransom payment has been publicly confirmed.
For Gamdom's customers, the unresolved question extends beyond stolen cryptocurrency to whether their gambling histories and personal information will eventually circulate online.
