Duelbits got cleaned out. Roughly $7 million, pulled from the crypto casino‘s hot wallets in late September 2026. The platform went dark, and it stayed that way while the company worked out what happened.
Security researchers spotted suspicious outflows on September 24. Duelbits confirmed the hack the same day. Early estimates were smaller, around $4.2 million to $4.3 million. Then more wallet activity turned up, and the number grew. Classic.
The loot wasn’t one coin. It spanned Ethereum, BNB Chain, Tron, and Bitcoin. The haul reportedly included ETH, BTC, USDT, BNB, TRX, SHIB, USDC, and DAI. Essentially a whole crypto buffet, and the attacker helped themselves to every dish.
Then came the speed. Within hours, much of the stolen money was consolidated into a single Ethereum address holding about 2,234 ETH, worth roughly $6 million at the time. The attacker also swapped a portion of the assets into ETH and DAI very quickly.
No slow, careful exploit here. It looked like someone simply had the keys. That’s fundamentally what Scam Sniffer and PeckShield suspect. Both tracked the transfers and linked them to a likely private-key compromise. Hot wallets are vulnerable to hacking and malware because of their online connectivity, which makes protecting private keys critical.
Duelbits hot wallets sent funds to newly created addresses across several chains. The speed suggested direct wallet control, not a slow, multi-stage exploit. Still, no confirmed exploit chain has been made public.
Co-founder Joe confirmed the loss and said user funds were safe. The shutdown, the company said, was a precaution while the investigation continued. Duelbits would stay offline until things got clearer. Reassuring, sure. Also not exactly an explanation.
The company put re-filling hot wallets first, prepared assets for immediate payouts, and started planning a relaunch. It did reopen. But the public explanation of the breach stayed incomplete, and no full postmortem was released in the initial coverage. So the how remains fuzzy.
Coverage called it one of the larger crypto-casino wallet incidents of 2026. That tracks. A similar incident hit Stake in 2023, when attackers made off with $40 million. The attack showed the risk of keeping large balances in hot wallets across multiple chains. Funds came from hot wallets, not long-term cold storage.
This was not the first time Duelbits had been targeted, since a previous breach in February 2024 cost the platform $4.6 million after attackers exploited a vulnerability in its hot wallet.
Small mercy, maybe. Still, a lot of money sat in the spot that gets hit.
