Gamdom: Crypto Casino Loses Over $3M From Its Hot Wallets, Three Weeks After Duelbits

On the afternoon of 13 October 2026, money started leaving the wallets of Gamdom, an online casino and sportsbook that takes its bets in cryptocurrency. In about an hour, more than $2.3 million went out to five addresses on five networks: Ethereum, Solana, BNB Chain, Tron and the XRP Ledger. At least four of the receiving addresses had never been used before. Gamdom said nothing until 18:45 UTC, roughly two hours after the large transfers had finished, and even then only that the site was offline and would be back soon.

It was the second crypto casino in three weeks to have its cash drawer emptied. On 24 September, Duelbits lost about $7 million in the same kind of raid. Gamdom's founder, Felix Roemer, who posts on X as @Romer, put his company's loss at "just over $3m." An independent on-chain investigator who goes by vxdb counted about $4.2 million. Gamdom has not explained the gap.

A disk failure that was not a disk failure

Gamdom's explanation arrived on 14 October and began with a hardware fault. "Approximately 24 hours ago, we detected a potential disk failure on one of our servers," the company wrote. "During our investigation, we identified an unauthorized connection on one of our automation servers, which prompted further investigation." It then took every system offline and said that user funds were safe.

Later that day Roemer added the part that mattered. "Long story short, we noticed a breach attacking our hot wallet system & we took measures to stop the drain, in total we lost just over $3m to the breach." He said the money left in the hot wallets had been moved to cold storage and that the site would be back "in a couple of hours." On 15 October he wrote that Gamdom was "still taking some more time to bring it all back."

Who Gamdom is

Gamdom says it has operated since 2016, the year gambling with Counter-Strike weapon skins, virtual items players traded for real money, was at its peak. It has since grown into a full casino offering more than 8,000 games, from slots and live dealer tables to its own crash, roulette and dice games, plus sports and esports betting. It still lists CS2 skins as a way to deposit. Its customers pay in crypto, by bank transfer or by e-wallet.

According to its own terms of service, Gamdom is run by Moon Revolution Limitada, a company registered in San Jose, Costa Rica, under gaming licence ALSI-152406043-FI from the government of Anjouan, an island in the Comoros, off the coast of East Africa. Gamdom's terms bar players in countries including Australia, France, Germany and Austria. Its best-known face is the streamer Steve Will Do It, who gambles on the site live in front of his audience.

How the money got out

A crypto business keeps most of its customers' money in cold storage, wallets kept offline, like cash in a bank vault. A smaller float sits in hot wallets that are connected to the internet, the equivalent of the cash drawer at the counter, so that winnings can be paid out in seconds. Any wallet moves money only when a transfer is signed with its private key, a long secret number that works like the only signature a bank will ever accept. Whoever can produce that signature can move the money, and the blockchain does not ask who they are.

Gamdom's statement points to the machine that does the signing. An automation server is the computer that processes withdrawals without a human in the loop. If an outsider has a connection to it, that outsider can ask it to pay. Gamdom has not said what the server controls, how the intruder got in, or whether any private key was copied. No security firm has published a root cause either. As with Duelbits, nobody needed to break any code: there was no smart contract, the kind of program that moves money by itself, to trick.

The size of the hole is clearer from outside. FairGambling, a gambling watchdog site that tracks known casino wallets, had Gamdom's hot wallets holding about $10.5 million on 12 October and about $76,000 a day later. That drop includes whatever Gamdom moved to cold storage on purpose, so it is not the amount stolen. But it shows how much was sitting in the drawer.

Where the money went

vxdb's count, built on data from the blockchain analytics firm Arkham Intelligence, splits the $4.2 million like this: about $2.2 million on Ethereum and networks that run the same way (BNB Chain, Polygon, Arbitrum and Optimism), $965,000 on Solana, $668,000 in bitcoin and $375,000 on Tron.

©CMZ chart. Data: vxdb (Arkham), via Cryptopolitan, PANews, ChainCatcher

The Ethereum trail is the easiest to follow. A newly created wallet took in about $1.2 million from three Gamdom hot wallets and within minutes began swapping its USDT and USDC into DAI. USDT and USDC are stablecoins, digital dollars meant to be worth exactly one US dollar, issued by the companies Tether and Circle. Both companies can freeze their coins at an address flagged as criminal. DAI has no company behind it to ask. A second wallet collected about $870,000 in DAI, much of it through Relay, a bridge that moves coins between networks. By 15 October the two wallets held about $1.8 million in DAI and 87 ETH between them. Other funds were moved through bridges and swaps to Hyperliquid, a crypto trading platform, and THORChain, a network for swapping coins between blockchains. The Tron and XRP Ledger wallets were forwarding their takings within 80 minutes.

Two casinos, one pattern

The comparison with Duelbits is close. Both are crypto casinos with sports betting. Both lost hot wallets on several networks at once, inside an hour, with no code exploited. Both said user funds were safe and neither published proof. Both victims' figures disagree with what investigators counted on-chain: Duelbits claimed more than the traceable amount, Gamdom claimed less. Neither has said how the attacker got in.

There is no public evidence that the same people did both. No firm has linked the addresses, and no one has attributed either theft to a known group. The bigger precedent is Stake, one of the largest crypto casinos, which lost about $41 million from its hot wallets in September 2023; the FBI later blamed North Korea's Lazarus Group. Nothing has tied Gamdom's thief to North Korea.