TLDR
- Crypto casino Duelbits took its site offline after attackers stole about $7 million from its hot wallets.
- Funds were taken from wallets on BNB Chain, Ethereum, Tron and Bitcoin.
- Security firm Scam Sniffer suspects a compromised private key, but Duelbits has not confirmed this.
- Most stolen tokens were swapped for Ether and moved to one address holding about 2,234 ETH.
- Duelbits says user account balances are safe and the site will stay offline until the investigation ends.
Crypto casino Duelbits has taken its website offline after attackers stole about $7 million from its wallets. The company says it is investigating the breach.
Duelbits has told users that funds held in their accounts are not affected. It has not explained how the attackers got into its systems or when the site will reopen.
How the Duelbits Hack Unfolded
Blockchain security firm Scam Sniffer was the first to spot a series of unusual transfers from Duelbits wallets. The transfers came from wallets on BNB Chain, Ethereum and Tron.
A loss of 8.1 Bitcoin from the casino’s Bitcoin wallet was found later. That brought the number of affected networks to four.
The drained wallets were hot wallets. These are online wallets that platforms use to hold enough crypto to handle customer deposits and withdrawals.
Hot wallets allow fast transactions. But they carry more risk if someone gains access to the credentials that control them.
Duelbits co-founder Joe confirmed the attack on X. “Confirming a ~$7M hack. Still investigating exactly what happened and how,” he wrote.
The attacker collected 836 ETH, about 593,000 USDT, 97,000 USDC, 31,500 DAI and 12.4 billion SHIB.
Scam Sniffer said the speed and size of the withdrawals suggest a private key was compromised. A private key is the master credential that controls a crypto wallet.
Anyone who holds a wallet’s private key can move funds from it without breaking into a blockchain. Duelbits has not confirmed that this is what happened.
Stolen Funds Swapped Into Ether
Most of the stolen tokens were exchanged for Ether. The Ether was then gathered into a single address.
After the transfers, that address held about 2,234 ETH, worth roughly $6 million. The funds had not moved again at the time they were traced.
Converting the tokens to Ether could make recovery harder. The companies behind USDT and USDC can freeze their tokens when they are linked to theft.
Ether works differently. It has no central issuer, so no company can freeze it after a hack.
Several questions remain open. It is not yet known how the wallet credentials were exposed or whether customer deposits were held in the affected wallets.
There has also been no independent check to confirm that user funds are safe, as Duelbits has claimed. The company has not shared further details so far.
Users are being warned to avoid any refund or recovery links that appear during the outage. Links shared at times like this often aim to steal wallet details and recovery phrases.
For now, Duelbits remains offline. The co-founder said the site will stay down until the investigation is complete and the company has refilled its hot wallets.
