Duelbits Crypto Casino Experiences Abnormal Outflow of Approximately $4.2 Million from Hot Wallets on Ethereum, BNB Chain, and Tron
Duelbits hot wallet hacked for approximately $4.2 million
On-chain monitoring agency Scam Sniffer first reported that the crypto casino Duelbits experienced an abnormal outflow of about $4.2 million from its hot wallets on Ethereum, BNB Chain, and Tron, with funds transferred to new addresses, indicating a private key theft rather than a contract vulnerability. The initial list included 836 ETH, 1.62 million USDT, 97,000 USDC, 209 BNB, and 192,000 TRX, most of which were later converted to ETH.
Subsequent on-chain analysis expanded the scope to Solana and Bitcoin. Yfarmx reconstructed the timeline: within approximately 57 minutes from 08:58 to 09:56 UTC on September 24, hot wallets across five chains were emptied; additionally, around 593,430 USDT, 96,805 USDC, 31,515 DAI, and 12.4 billion SHIB were transferred out on the Ethereum side. Valued that afternoon, the total across the five chains was about $6.07 million, which was aggregated into approximately 2,234.60 ETH through bridges like DeBridge and Relay, concentrated into a single address, totaling about $6.02 million, with only a test transfer of 0.1 ETH out from that address.
One of the founders, Joe, confirmed on a public account that approximately $7 million was stolen, stating that they are still investigating the method and path, and wrote "user funds are safe"; the platform announced an investigation and went offline around 11:42 UTC, planning to reopen once the hot wallet is replenished. DappRadar had ranked it 17th among 43 tracked crypto casinos before the incident, monitoring wallet deposits of about $5.7 million. In February 2024, the platform had already recorded a theft of about $4.64 million; in 2023, a similar private key theft took approximately $40 million from the Stake hot wallet.
The attack address was marked on the EVM side starting with 0xa77e24 and ending with 05aef76; funds were first swapped from TRON's USDT to TRX via Sunswap, then bridged in multiple transactions to Ethereum. PeckShield estimated the abnormal outflow from ETH and BNB Chain at around $4.3 million, consistent with Scam Sniffer's initial report, with the difference coming from later-added BTC, SOL, and meme assets.
Mechanically, what was sold was the operational funds prepared for payouts in the hot wallet, and what was bought was a single set of private keys capable of signing across five chains. The driving factor of the incident was the loss of key control, not market fluctuations. Funds moved from the casino's operational address through bridges and exchanges into a single ETH address, awaiting the next step of obfuscation or off-market liquidation; the beneficiary was the attacker controlling that address, while Duelbits, which must replenish the hot wallet with its own funds and bear the pressure of offline operations, and users with balances in the hot wallet payout queue, were under strain — the official statement claimed user funds were safe, but the platform again exposed the same weakness in its hot and cold wallet separation. Stablecoins and altcoins were sold off first, ultimately leaving ETH in inventory, indicating that the attacker prioritized chips that could be uniformly managed on Ethereum.
Source: Public Information
ABAB AI Insight
Duelbits is a crypto casino and sports betting platform licensed in Curacao, and its hot wallets must remain active 24/7 to facilitate immediate payouts. In February 2024, it had already been drained of about $4.64 million under the same logic, and the recurrence in September 2026 indicates that after the last incident, they did not separate the multi-chain hot keys into independently controlled interfaces. Scam Sniffer first reported the $4.2 million across three chains because the ETH, BSC, and TRON tags are the easiest for monitors to hit; BTC and SOL appeared later due to the time required for tagging and cross-chain tracking. The founder emphasized user fund safety, which implicitly acknowledges that the operational hot wallet was compromised, while cold storage or user balances were kept separately; however, the scale of the hot wallet was close to the total on-chain deposits of the platform, indicating a thin safety cushion.
The capital path is "hot wallet float — private key — cross-chain bridge — single ETH address." The attacker emptied five chains within 57 minutes, indicating that the key was a single set, not five independent intrusions. The bridges chosen were DeBridge and Relay, aimed at quickly converting non-ETH assets into ETH that can remain on Ethereum, reducing exposure when the stablecoin issuer freezes addresses. Ultimately, over 2,000 ETH remained inactive, commonly seen in scenarios waiting for someone to run or for a mixing window, not immediately dumped. The platform went offline to replenish the wallet, incurring costs from business suspension and using its own funds to fill the gap, with equity and brand depreciation occurring before user runs on the bank.
Comparing to the $40 million hot wallet theft from Stake in 2023, and multiple instances of centralized gambling and exchange "hot ends being drained, while cold ends remain": all treat immediate payouts as a product and view private keys as a single point of failure. The industry stage is still stuck in shared signatures for multi-chain hot wallets, rather than independent hardware and threshold signatures for each chain. Whoever can separate the payout hot wallet to prevent it from being emptied with a single key will survive the next round in the casino race; whoever continues to use the same key to manage five chains will again be flagged red by monitors.
Structural judgment indicates concentrated operational risks before the technical replacement is completed. Pricing power lies between payout speed and key management: to achieve second-level payouts, the wallet must be hot, and to be hot, the private key must be placed in an environment that can sign across multiple chains. The mechanism amplifies the surface area of the same key with multi-chain expansion, and bridges only standardize the format of the stolen funds, not explain where the key was leaked. Before threshold signatures and independent chain hot ends become widespread, the real leverage for crypto casinos is the ratio of hot wallets to deposits, not the text of the license.
ABAB News · Cognitive Law
Multi-chain hot wallets sharing a single key is equivalent to opening five chains at once
Bridges do not create hackers, they only convert stolen funds into the same currency
Another theft indicates that the last fix was an announcement, not a key architecture repair