Crypto casino and sportsbook Duelbits has been taken offline after attackers drained millions of dollars from its hot wallets in what is suspected to be a private-key compromise.

Security researchers first flagged suspicious transfers from wallets linked to Duelbits on Sept. 24. Early estimates put the losses at roughly $4.2 million across Ethereum, BNB Chain and Tron. Subsequent blockchain analysis raised the estimated total to nearly $5.9 million after additional activity involving Bitcoin and Solana.

The varying figures mean the final loss amount remains under investigation. Reports also differ on how many networks were affected, and the widely cited $7 million figure has not been independently confirmed.

Hot Wallets Targeted

Assets stolen in the incident included 836 ETH, 1.62 million USDT, 97,000 USDC, 209 BNB and 192,000 TRX. Investigators also traced 8.1 BTC in related activity. Most of the stolen funds were subsequently converted into Ether.

According to blockchain monitors, the transfers moved the funds into newly created addresses. The transaction pattern points to compromised private-key access, though investigators have not publicly established the exact method used in the attack. Private keys are the credentials that control a crypto wallet's funds, meaning whoever obtains them can authorize outgoing transfers on their own, and confirmed blockchain transactions are irreversible, which is why analysts typically follow stolen funds address by address as they move.

A separate blockchain security database logged the incident as a private-key leakage event and estimated the loss at about $4.9 million. The database also confirmed that Duelbits took its platform offline while investigating.

Funds Consolidated Into Ethereum

The attackers' decision to convert multiple tokens into ETH consolidated the stolen assets into a more liquid cryptocurrency. On-chain tracking showed the funds moving toward a small number of addresses, enabling security researchers to follow the transfers.

The incident underscores the risks of holding operational cryptocurrency in hot wallets. Because these wallets stay connected to systems capable of authorizing transactions, they are more convenient than offline storage but also more exposed to credential or key compromises. Across the industry, operators keep such wallets precisely so they can process user deposits, withdrawals and payouts without delay, accepting the added exposure as the tradeoff for always-available liquidity.

Duelbits has not publicly confirmed the final amount stolen or disclosed the precise cause of the breach. The platform remained offline as of the latest reporting, with no announced timeline for returning to service, and a firmer accounting of the loss will depend on the ongoing on-chain analysis as researchers continue tracking the stolen assets.

Source: CryptoMeter io