Crypto casino Duelbits hacked again: about $6 million taken from five blockchains in under an hour

Someone with the keys to Duelbits’ hot wallets emptied them on five blockchains on Thursday 24 September 2026. Duelbits is a crypto casino and sportsbook. Between 08:58 and 09:56 UTC its operating wallets on Ethereum, BNB Chain, Tron, Solana and Bitcoin sent out ether, stablecoins, SOL, BNB, TRX, bitcoin and meme tokens worth about $6.07 million at 14:29 UTC prices. Within the hour, bridges had turned almost all of it into ether, and by 13:08 UTC it sat in one Ethereum wallet holding 2,234.60 ETH, about $6.02 million.

Duelbits said at 11:42 UTC that it was “currently investigating a security incident affecting the site” and had taken the site offline as a precaution. The Ethereum wallet emptied on Thursday made its first transaction on 14 February 2024, the day after Duelbits lost about $4.6 million from its previous hot wallet. At 14:35 UTC the proceeds were still sitting where the attacker parked them.

What happened, minute by minute

The theft took 57 minutes, from the first Tron transfer at 08:58:36 to the last bitcoin reaching the attacker at 09:55:39. All times are UTC on 24 September 2026 and come from the transactions themselves.

How much was taken?

The attacker ended up with ether and bitcoin worth about $6.07 million, valued at the Chainlink prices read at 14:29 UTC on 24 September: $2,691.95 an ether and $84,808.10 a bitcoin. Because nearly everything became ether, the cleanest measure is how much ether each chain’s haul turned into, after the swap and bridge costs.

The first itemised figure was PeckShield’s $4.3 million, posted at 10:14 UTC. It covers the two chains itemised by then, Ethereum and BNB Chain, including 836 ETH, 1.146 million USDT and 209 BNB. The Solana, Bitcoin and Tron legs came to light later in the day.

The Ethereum, Tron and Bitcoin amounts are read straight from those chains. The BNB Chain and Solana amounts come from the bridge records: deBridge’s order data shows the BNB Chain leg starting on chain 56, which is BNB Chain, and Relay’s records name the Solana sender and the ether it received.

How did the attacker get the money out?

Everything on the record points to stolen private keys. A private key is the secret number that authorises spending from a crypto address, and whoever holds it controls the money outright. Duelbits keeps player deposits in wallets it controls, and a hot wallet is one whose key sits on an internet-connected server so software can sign withdrawals automatically.

Four features of the transactions carry that reading.

• The emptied wallets are ordinary key-controlled accounts. The Duelbits Ethereum wallet, 0x0144…CC9B, is a plain externally owned account with no contract code, so every transfer out of it was signed with its key.
• Native coins moved on every chain. ETH, BNB, TRX, SOL and BTC have no approval function, so the only way to move them is a signature from the key. A phishing “drainer” works through token approvals and reaches tokens alone.
• The Ethereum sweep was scripted. DAI left at 09:00:35, SHIB at 09:00:59, USDC at 09:01:23, USDT at 09:02:11 and 836 ETH at 09:02:47, leaving the wallet with a few thousandths of an ether.
• Two kinds of key were used. Ethereum, BNB Chain, Tron and Bitcoin sign with secp256k1 keys, and Solana signs with ed25519 keys. Whoever did this held keys of both kinds within the same hour, which puts the breach in the system that stores or signs with all of them.

CertiK, counting the outflows at 11:42 UTC, put them at about $6 million and noted that “a similar incident involving Duelbits wallets occurred in 2024”.

The same thing happened in February 2024

On 13 February 2024 Duelbits lost about $4.6 million. Halborn’s review of that month’s hacks records that “the attacker exploited a security vulnerability to drain the tokens from the project’s hot wallet”. The old wallet, 0x4E80…2e12, carries the tag “Old Duelbits” on Blockscout, and it sent a burst of transfers out between 10:22 and 11:36 UTC that day. The attacker then used 0x3933…a666.

The wallet emptied on 24 September, 0x0144…CC9B, received its first transaction at 06:27 UTC on 14 February 2024, the morning after that loss. Blockscout tags it “Duelbits” with a note reading “The is the new Duelbits hot wallet. Reported by Duelbits.” It is the replacement Duelbits set up after the first hack, and it went the same way 31 months later: an operating wallet emptied in one pass by whoever could sign for it.

The two incidents together come to about $10.7 million taken from the casino’s hot wallets.

How the money was turned into ether

The attacker used cross-chain bridges as swap desks. A bridge takes a coin on one chain and pays out an equivalent amount on another, with the payout coming from a pool of liquidity providers, so the ether that arrives is fresh ether from the bridge’s side.

• BNB Chain to Ethereum through deBridge, in seven fills.
• Tron to Ethereum through Relay, in sixteen orders, after the USDT was swapped for TRX on SunSwap, Tron’s largest exchange, six minutes after it was stolen.
• Solana to Ethereum through deBridge and Relay. Two Relay orders of about 1,717.7 SOL each, about $197,500 apiece, were refunded, and the attacker broke the amount into smaller orders. The 44,850 TRUMP taken from Duelbits was swapped first, in two trades at 09:03 and 09:07, for 774.48 SOL, about $89,000 at Chainlink’s SOL/USD price of $114.98.
• Bitcoin to Ethereum through Chainflip, which swaps native bitcoin for ether: 2 BTC at 09:55 and 3 BTC at 10:05 became 62.64 ETH and 94.09 ETH.
• On Ethereum itself, the USDT, USDC, SHIB and DAI went through the deBridge, Relay and MetaMask swap routers.

The speed decided what could be frozen. Tether and Circle can blacklist an address and lock the USDT or USDC in it, which takes a report and a check. The Tron USDT was swapped six minutes after it left Duelbits, the Ethereum USDC after 26 minutes and the Ethereum USDT within 38 minutes. By the time an issuer could act, the stablecoins had become ether, which nobody can freeze.

The whole route ran through bridges and swap routers, and every hop is on public ledgers, which is how the trail can be followed to its end.

Where the money is now

At 14:35 UTC on 24 September the proceeds sat in 0x8dB9…C306, holding 2,234.60 ETH, about $6.02 million at Chainlink’s 14:29 UTC price. Its only outgoing payment was a 0.1 ETH test at 12:41 UTC, before the last deposits arrived. The last deposit, 155 ETH from the Bitcoin leg, landed at 13:08:23.

That balance includes 74.81 ETH, about $201,400, paid in from two exchanges, Kraken and ChangeHero, set out in the next section. A further 3.1 BTC, about $262,900, left the attacker’s bitcoin addresses in a transaction with a very low fee, which was confirmed at 14:36 UTC and paid an address that looks like a third Chainflip deposit. At 15:00 UTC the final wallet still held exactly 2,234.60 ETH. The exploiter wallets on Tron, Solana and BNB Chain are empty.

The wallet now draws a stream of worthless transfers from look-alike addresses. This is address poisoning: scammers generate an address sharing the first and last few characters of a real one and send it dust, hoping someone later copies the wrong one from the history. It is a separate, opportunistic scam, and the reason to check every character of an address before relying on it.

A Kraken account sent money into the trail

Two payments into the laundering wallets came from exchanges. The address Blockscout tags “Kraken: Hot Wallet 2” sent 60 ETH, about $161,500, in three withdrawals at 10:56, 11:22 and 12:07 UTC to 0x81F8…75e2, which passed all 60 ETH on at 12:17 UTC to a wallet that paid 476.53 ETH into the final one. A withdrawal from Kraken is made by a customer, and Kraken verifies a customer’s identity before they can withdraw, so a named, verified account holder sent ether into the attacker’s wallets while the laundering was under way.

That person may be the attacker, a helper or a hired intermediary. Either way, Kraken holds the account’s identity documents, login history and IP addresses, and law enforcement can ask for them. It is the strongest lead on who is behind the theft. The likeliest reason for the withdrawals is gas, the ether needed to pay transaction fees from freshly made wallets.

The second payment, 14.81 ETH, about $39,900, came from the address Blockscout tags “changehero: Hot Wallet”. ChangeHero is an instant exchange that swaps one coin for another with lighter checks than Kraken, and arrived in two parts at 10:55 and 12:16 UTC. ChangeHero keeps order records, including the addresses on both sides of each swap.

What Duelbits players should know

A Duelbits balance is a claim on the company. The coins behind it sat in wallets Duelbits controlled, so whether players are paid in full depends on the operator’s reserves. Duelbits’ statement says the site is offline “while we investigate and work to ensure it is safe to restore service”.

Fake refund links circulate after every exchange or casino hack, so the safe course is to follow only Duelbits’ own site and official accounts. The page now shown at duelbits.com reads “Be back soon!” and describes “planned maintenance”. It names the operator as Liquid Entertainment N.V., registered in Willemstad, Curaçao, with Herpestidae Services Limited in Nicosia, Cyprus, handling payments and support.

Fresh wallets from the same system carry the same risk

Custodial casinos keep large balances online across many chains and pay withdrawals automatically, which makes their hot wallets some of the most valuable targets in crypto. Stake lost about $41 million on or about 4 September 2023 from an online casino and betting platform, a theft the FBI attributed two days later to North Korea’s Lazarus Group.

Duelbits’ answer to the 2024 loss was a new hot wallet, and on 24 September whoever could sign for it emptied it in two minutes, as the old one had been emptied. The defences are well known: a separate key setup for each chain so one breach stays on one chain, most of the money in cold storage behind withdrawals a person approves, and limits and alerts on each hot wallet that would stop a scripted sweep before its two minutes were up.

For now the money sits in one wallet, in plain view.