Duelbits hot wallet hacked for approximately $4.2 million

On-chain monitoring agency Scam Sniffer first reported that the crypto casino Duelbits experienced an abnormal outflow of about $4.2 million from its hot wallets on Ethereum, BNB Chain, and Tron, with funds transferred to new addresses, indicating a private key theft rather than a contract vulnerability. The initial list included 836 ETH, 1.62 million USDT, 97,000 USDC, 209 BNB, and 192,000 TRX, most of which were later converted to ETH.

Subsequent on-chain analysis expanded the scope to Solana and Bitcoin. Yfarmx reconstructed the timeline: within approximately 57 minutes from 08:58 to 09:56 UTC on September 24, hot wallets across five chains were emptied; additionally, around 593,430 USDT, 96,805 USDC, 31,515 DAI, and 12.4 billion SHIB were transferred out on the Ethereum side. Valued that afternoon, the total across the five chains was about $6.07 million, which was aggregated into approximately 2,234.60 ETH through bridges like DeBridge and Relay, concentrated into a single address, totaling about $6.02 million, with only a test transfer of 0.1 ETH out from that address.

One of the founders, Joe, confirmed on a public account that approximately $7 million was stolen, stating that they are still investigating the method and path, and wrote "user funds are safe"; the platform announced an investigation and went offline around 11:42 UTC, planning to reopen once the hot wallet is replenished. DappRadar had ranked it 17th among 43 tracked crypto casinos before the incident, monitoring wallet deposits of about $5.7 million. In February 2024, the platform had already recorded a theft of about $4.64 million; in 2023, a similar private key theft took approximately $40 million from the Stake hot wallet.

The attack address was marked on the EVM side starting with 0xa77e24 and ending with 05aef76; funds were first swapped from TRON's USDT to TRX via Sunswap, then bridged in multiple transactions to Ethereum. PeckShield estimated the abnormal outflow from ETH and BNB Chain at around $4.3 million, consistent with Scam Sniffer's initial report, with the difference coming from later-added BTC, SOL, and meme assets.

Mechanically, what was sold was the operational funds prepared for payouts in the hot wallet, and what was bought was a single set of private keys capable of signing across five chains. The driving factor of the incident was the loss of key control, not market fluctuations. Funds moved from the casino's operational address through bridges and exchanges into a single ETH address, awaiting the next step of obfuscation or off-market liquidation; the beneficiary was the attacker controlling that address, while Duelbits, which must replenish the hot wallet with its own funds and bear the pressure of offline operations, and users with balances in the hot wallet payout queue, were under strain — the official statement claimed user funds were safe, but the platform again exposed the same weakness in its hot and cold wallet separation. Stablecoins and altcoins were sold off first, ultimately leaving ETH in inventory, indicating that the attacker prioritized chips that could be uniformly managed on Ethereum.

Source: Public Information