Gamdom: A Gang Demands a $15M Bitcoin Ransom in a Week When Coinbase and Bithumb Also Leaked Data

In the last week of October 2026, four crypto and finance companies admitted that outsiders had got at their data, and a new extortion gang called WhiteArmor put a price on a fifth. Coinbase, the largest US crypto exchange, said contact details of some customers had leaked through a supplier. Bithumb, one of South Korea's biggest exchanges, said someone had broken into its staff messaging system. Two Korean investment firms, Daishin Securities and Mirae Asset, reported intrusions of their own. And WhiteArmor told the crypto casino Gamdom to pay $15 million in bitcoin or see what it says are 15.4 million customer accounts published.

No company reported any crypto stolen in these incidents. What leaked, or is claimed to have leaked, is information: names, email addresses, phone numbers and, in one case, home addresses. That matters more than it sounds, and the reason is at the end of this story.

One point needs to be clear from the start. WhiteArmor has claimed Gamdom and a Monero swap service called Wagyu. No company, investigator or published report seen by CMZ ties WhiteArmor to the Coinbase, Bithumb, Daishin or Mirae Asset incidents. Some reports have bundled them together, but on the evidence so far they are separate events.

Coinbase: "Coinbase has not had a data breach"

Coinbase spoke first, through its Coinbase Support account on X late on 27 October. "Coinbase has not had a data breach," it wrote. The problem, it said, was at Amplitude, an American company whose software tells apps how customers use them, much as a shop might hire a firm to count footfall. Amplitude "experienced a security incident" that affected "a small subset" of Coinbase customer contact data, along with data belonging to other Amplitude clients.

Coinbase added: "We've found no evidence of unauthorized access to Coinbase systems, and customer funds were not impacted." It said it is emailing affected customers as the law requires. It has not said how many people are affected or when the intrusion began. Reports describe the data as email addresses and phone numbers. CMZ found no public statement from Amplitude itself.

A figure of about 70,000 affected users is circulating. It was attributed to the blockchain security firm SlowMist and spread by the news account WuBlockchain. Coinbase has not confirmed it. The number is strikingly close to the nearly 70,000 customers hit in Coinbase's much larger leak of May 2025, when criminals bribed customer support contractors at the outsourcing firm TaskUs to copy names, addresses and ID documents, then demanded $20 million. Coinbase refused to pay and put its costs at $180 million to $400 million.

Bithumb and the Korean brokers

On 27 October Bithumb found that an outsider had got into its internal mobile groupware, the office messaging and email system staff use at work, run on a third-party product called Daou Office. It reported the break-in the same day to the Korea Internet and Security Agency and the Personal Information Protection Commission, South Korea's data regulator. Employee names, work email addresses and mobile numbers were exposed. Bithumb said it was "analyzing the exact scope, including the possibility of member information being involved." It said the system is separate from its trading platform, so customers' coins cannot be reached through it.

Daishin Securities, a Korean stockbroker, confirmed that personal and credit information of 38,490 customers was exposed. It first spotted suspicious traffic on 17 October, aimed at a server behind its online account-opening service. Names, email and home addresses and account numbers were among the fields, the numbers encrypted. Mirae Asset Global Investments said outsiders had viewed internal business information on some of its web systems, but that no investor's personal or credit data leaked and nothing was lost.

Lee Chan-jin, governor of South Korea's Financial Supervisory Service, the country's banking watchdog, said at least 16 financial firms faced cyberattacks in October, with about 100,000 cases of leaked data. The news site Protos reported that the presidential office held an emergency meeting on the incidents.

WhiteArmor and the $15 million demand

WhiteArmor first appeared on ransomware tracking lists on 21 October. It runs what security sites call a leak site, a web page where it names victims and threatens to publish their files. It has also claimed companies far from crypto, including Whirlpool and the electronics maker Hisense, from which it wants $5 million. None has confirmed a break-in, and a listing on a leak site is a claim, not proof.

On 26 October WhiteArmor listed Gamdom, a crypto casino and sportsbook. It says it holds 15,420,003 accounts with 146 columns of data each, and that it got in through an old internal machine account linked to Metawin, another crypto casino, which had kept administrator rights for years without its password ever being changed. As evidence it posted a sample of about 100 records. It wants $15 million in bitcoin, with payment details sent to Gamdom by email.

Gamdom's founder, Felix Roemer, disputes the scale. According to Bitcoin.com News and crypto.news, he said the attackers did not take the full database and reached only a few hundred accounts. Later statements reported by the same outlets accepted that usernames, email addresses and betting activity may have been exposed, but said identity documents were not. Gamdom has not published a formal notice. No payment has been reported.

The demand landed two weeks after Gamdom lost just over $3 million from its hot wallets, the internet-connected cash drawers that pay out winnings, on 13 October. Nobody has shown that the wallet theft and the data claim are the same attack. The gambling site Gambling Lore reported that a hacker using the name Veryso claimed to have taken Gamdom records on 13 October, a different name from WhiteArmor.

WhiteArmor also listed Wagyu, a service for swapping Monero, a privacy coin built to hide who pays whom, into other coins without identity checks. Files it supplied hold 38,628 orders and 10,139 IP addresses, which can point to a user's home connection, dated 18 July to 26 October, according to an analysis by the security firm Hudson Rock, which said it could not verify them. Wagyu reportedly refused a $5 million ransom.

Why an email address is worth stealing

Leaked contact details are the raw material for the most common crypto theft of all: the fake support call. A criminal who knows that a person has a Coinbase account, and has that person's phone number and email, can ring up posing as Coinbase security, say the account is under attack, and talk the victim into moving coins to a "safe" wallet the caller controls. Bithumb learned this in 2017, when data on about 31,800 users leaked from an employee's home computer and some of those customers then lost money to callers posing as the exchange. In Brooklyn, a man who posed as Coinbase security on the phone took about $15.9 million from roughly 100 people between 2023 and 2024, and was sentenced in September 2026.

Home addresses add a second risk. Crypto holders have been robbed and kidnapped at home by gangs who knew what they owned, and a list of gamblers with their winnings is a list of targets. Coinbase does not phone customers to ask them to move coins, and no genuine exchange does.