Duelbits: Crypto Casino Loses $7M to Hackers, Its Second Raid in Three Years

At 08:58 UTC on 24 September 2026, 476,058 USDT left a wallet on the Tron network that belonged to Duelbits, an online casino and sports-betting site that takes its bets in cryptocurrency. USDT, issued by the company Tether, is a stablecoin: a digital dollar meant to be worth exactly one US dollar. One minute later, 552,762 more USDT left a Duelbits wallet on BNB Chain. Within four minutes the same wallet address, on Ethereum, had sent out a further 593,430 USDT, 96,805 USDC, 31,515 DAI, about 12.4 billion SHIB and 836 ETH. Nobody at Duelbits had asked for any of it.

By the afternoon Joe, a Duelbits co-founder who posts on X under that first name only, was "confirming a ~$7M hack" and saying the team was "still investigating exactly what happened and how." He added that user funds were safe. The site went dark for nearly three days.

It was the second time. In February 2024 the same casino lost about $4.6 million in what security firms also suspected was a stolen key, replaced the wallet that had been robbed, and published the new address. That replacement wallet is one of the wallets drained in September 2026.

Who Duelbits is

Duelbits was founded in 2020 and operates under a gaming licence from Curaçao, the Dutch Caribbean island that licenses a large share of the world's crypto casinos. It is not a small back-room operation. In the 2022/23 Premier League season it was Aston Villa's official European betting partner, with its name on the advertising boards at Villa Park. In 2023 it replaced the car seller Cazoo as title sponsor of three World Snooker Tour events, including the Tour Championship. It has also signed the footballer Luis Suarez as a brand ambassador, and in 2024 it won Best Crypto Operator at the EGR Operator Awards in London.

In an April 2026 blog post, Duelbits wrote under the heading "Track record" that it had operated since 2020 and that "no security breaches, hacks, or unauthorised fund access incidents have been reported in that time." The same page said player money sat in "offline, air-gapped wallets." Rekt News, the crypto incident site, pointed out on 6 October that the first claim contradicted Duelbits' own February 2024 statement admitting a "security breach" and an "unauthorized withdrawal."

How the money got out

A crypto business keeps its customers' money in two places. Most of it sits in cold storage, wallets kept offline, like cash in a bank vault. A smaller float sits in hot wallets connected to the internet, the equivalent of the cash drawer at the counter, so that winnings can be paid out in seconds. Any wallet, hot or cold, moves money only when a transfer is signed with its private key, a long secret number that works like the only signature a bank will ever accept. Whoever holds the key can move the money, and the blockchain does not ask who they are.

The pattern on 24 September looked like a stolen signature. Step one: a wallet on Tron was emptied. Step two: within a minute the BNB Chain wallet followed. Step three: the same address on Ethereum sent out its stablecoins and tokens, then its 836 ETH at 09:02 UTC. Step four: at 09:42 UTC, 8.1 bitcoin left a Duelbits bitcoin wallet in a single transaction that gathered 121 smaller deposits. A Duelbits wallet on Solana was also emptied of about 5,326 SOL, 397,880 USDC and 44,850 TRUMP, the Trump-branded meme coin. Everything went to fresh addresses the attacker controlled.

No code was broken to do this. There was no smart contract, the kind of program that moves money by itself, to trick. Scam Sniffer, a crypto security firm that was first to raise the alarm at 09:52 UTC, called it a "suspected private key compromise", and the security firm SlowMist lists the method as "Private Key Leakage." That is an assessment, not a finding. Duelbits has not said how the attacker got the ability to sign.

Joe hinted at something. Late on 24 September he said Duelbits had "identified what happened", promised an official statement within 24 hours, and said the team was rebuilding its deposit and withdrawal servers "to make sure everything is 100% secure." He also wrote that "a few people ruined it for everyone else", without saying who they were or what they did. As of 10 October 2026 the promised statement has not been published.

Counting the loss

©CMZ chart. Data: Rekt News, Unchained, CoinDesk

The estimates climbed all morning. Scam Sniffer first saw about $4.2 million on Ethereum, BNB Chain and Tron. PeckShield, another security firm, put it at about $4.3 million at 10:15 UTC. Specter, an independent on-chain investigator, reached about $4.9 million once the bitcoin was added. CertiK, the blockchain auditing firm, flagged about $6 million at 11:42 UTC. Duelbits' own figure, from Joe, is about $7 million.

Rekt News later traced every receiving address across all five networks, Ethereum, BNB Chain, Tron, Solana and Bitcoin, and valued what arrived at about $6.07 million. It noted that this does not reconcile with the $7 million Duelbits gave and that Duelbits has never published a chain-by-chain account. The $7 million is the victim's own number and the best available statement of what it lost. The $6.07 million is the part anyone can check.

Where the money went

The attacker turned almost everything into ether, the native coin of Ethereum, which is easier to move in bulk. PeckShield said the Ethereum and BNB Chain assets were swapped into about 1,588 ETH and 31,500 DAI. Seven transfers through deBridge, a service that moves coins between networks, carried a further 263 ETH from BNB Chain to Ethereum. On Tron the stolen USDT was swapped into about 1.4 million TRX. By the end of 24 September, CoinDesk counted about 2,234 ETH, worth roughly $6 million, in a single consolidation wallet.

It did not stay there. ChainBounty, a community investigation group, recorded 20 deposits totalling 1,370 ETH into Tornado Cash between 26 and 28 September. Tornado Cash is a mixer, a pool where many users' coins are blended so that what comes out cannot be matched to what went in. In stock-market terms it is a way of turning a traceable share certificate into untraceable cash. An independent trace published on GitHub counted about 1,012 ETH still sitting in the consolidation wallet on 3 October.

Nobody has been named. No security firm has attributed the theft to a known group, no law enforcement agency has announced an investigation, and no exchange has publicly announced a freeze of any of the funds.