Duelbits Hit by Suspected Private Key Compromise as Losses Approach $6 Million
Key Takeaways
- •Blockchain security firm ScamSniffer traced roughly $4.2 million in outflows from Duelbits' hot wallets on Ethereum, BNB Chain and Tron to newly created addresses, a pattern consistent with a private key compromise.
- •Stolen assets included 836 ETH, 1.62 million USDT, 97,000 USDC, 209 BNB and 192,000 TRX, with most of the funds subsequently converted into ETH in an apparent laundering move.
- •Further outflows of 8.1 BTC from the Bitcoin hot wallet, valued near $680,000, plus about $1 million linked on Solana, raised the estimated total losses to between $5.9 million and $6 million.
- •Duelbits confirmed it was investigating a security incident and took its platform offline as a precaution, temporarily leaving users unable to access funds or place bets.
- •In 2024, hackers extracted $4.6 million from Duelbits through a similar private key compromise, raising questions about the platform's key management, hot wallet segregation and whether prior lessons were implemented.
Crypto casino and sportsbook Duelbits appears to have suffered a major security breach, with blockchain security firm ScamSniffer reporting roughly $4.2 million in outflows from the platform's hot wallets on Ethereum, BNB Chain and Tron to newly created addresses — a pattern consistent with a private key compromise. Private key compromises are among the most damaging failure modes in crypto, since control of a key is control of the funds — and hot wallets, kept online by to process user deposits and withdrawals, are a platform's most exposed attack surface.
The stolen assets included 836 ETH, 1.62 million USDT, 97,000 USDC, 209 BNB and 192,000 TRX. Most of the funds have since been converted into ETH, a common laundering tactic that consolidates heterogeneous tokens into a single, highly liquid asset.
The scope of the incident expanded as further monitoring came in. Duelbits' Bitcoin hot wallet recorded an additional outflow of 8.1 BTC, valued at approximately $680,000, bringing the confirmed total to around $4.9 million.
CertiK initially estimated losses at $4.6 million before on-chain investigator Specter clarified that the figure was closer to $4.9 million, with further sums traced on Bitcoin and, subsequently, about $1 million on Solana linked to the same campaign — pushing the potential total toward $5.9–6 million.
it actually $4.9M with another 600k+ on bitcoin
Theft addresses
bc1qhtu84kz3y94lvgl2t05zk84tqh57grvd82zvcl
TAvraZZFCZbDSZoyqWWRRsBkFgZqKaCGbK
0xA77e24Fe29d16E051e487ef4Ea7b056cb05aef76
0x6761c9b15815f4051773EDe39B42B95bdDB3EF1c— Specter (@SpecterAnalyst) September 24, 2026
The suspected theft addresses have been identified across Bitcoin, Tron, Ethereum and Solana, giving investigators a clear trail to track, though the swapping of funds into ETH suggests an attempt to complicate recovery and attribution.
Platform Response and a Troubling Precedent
In response to the incident, Duelbits confirmed it was investigating a security incident affecting the site and, as a precaution, took the platform offline while working to verify that it is safe to restore service. This is a standard containment measure, though one that leaves users temporarily unable to access funds or place bets — a reminder that on crypto gambling platforms, where player balances sit in the operator's custody, hot wallet security is effectively the first line of defense for user funds.
We're currently investigating a security incident affecting the site. As a precaution, the site has been taken offline while we investigate and work to ensure it is safe to restore service.
— Duelbits (@Duelbits) September 24, 2026
The company has yet to provide a full post-mortem explaining how the private keys were exposed, a detail the crypto community will be watching closely given the scale of the loss. When the site will come back online, and whether any of the roughly $6 million can be recovered from the now-public theft addresses, remain open questions as on-chain tracing continues.
Critically, this is not the first time Duelbits has faced such an attack. In 2024, CertiK reported that hackers exploited the platform and extracted $4.6 million through a similar private key compromise, withdrawing assets on Ethereum and BNB Chain and converting them to ETH — nearly identical behavior to the current incident.
#CertiKInsight In the last few hours there has been ~$6M of suspicious outflows from @Duelbits wallets
A similar incident involving Duelbits wallets occurred in 2024— CertiK Alert (@CertiKAlert) September 24, 2026
Cyvers Alert attributed that earlier breach to a loss of wallet access. For a platform handling continuous user deposits in Bitcoin, Ethereum and other digital assets, a repeat compromise raises pointed questions about key management practices, hot wallet segregation and whether lessons from the previous incident were fully implemented. The episode also underscores a broader reality for the crypto gambling sector, where operators keep large hot wallet balances to settle bets instantly — making those wallets a recurring target for attackers.
This article originally appeared on Metaverse Post.
