Duelbits Goes Offline After Hackers Drain $7M From Hot Wallets

TL;DR

• Crypto gambling platform Duelbits took its website offline after approximately $7 million was removed from its hot wallets.

• The company says customer funds remain safe, but the platform will stay offline until its investigation is complete.

• Scam Sniffer identified suspicious transfers across Ethereum, BNB Chain, Tron, and Bitcoin, pointing to a possible private-key compromise.

• Most of the stolen tokens were converted into ether and consolidated in a new address holding approximately 2,234 ETH.

Crypto gambling platform Duelbits has taken its website offline after attackers drained approximately $7 million from hot wallets operating across several blockchain networks.

Co-founder Joe confirmed the breach Thursday and said the company was still investigating how the attackers gained access. He maintained that customer funds remain safe.

Confirming a ~$7M hack. Still investigating exactly what happened and how.

Until we have clarity, Duelbits stays offline. User funds are safe.

Next steps: finish the investigation, re-top hot wallets, and bring Duelbits back online, launch Duelbits 2.0.

I'll keep posting… https://t.co/V4Zl4St31I

— Joe (@DuelbitsJoe) September 24, 2026

Duelbits said it will keep the platform offline until the investigation is completed and its hot wallets have been replenished. The company has not announced when normal service, including deposits and withdrawals, will resume.

Attack Affected Wallets Across Four Networks

Blockchain security company Scam Sniffer first identified the suspicious activity after Duelbits wallets began sending funds to newly created addresses.

The affected hot wallets operated across Ethereum, BNB Chain and Tron. Scam Sniffer later reported that Duelbits’ Bitcoin wallet had also lost 8.1 BTC.

🚨 Duelbits hot wallets on Ethereum, BSC and Tron saw ~$4.2M in outflows to newly created addresses, in a suspected private key compromise.

Assets moved included 836 ETH, 1.62M USDT, 97K USDC, 209 BNB and 192K TRX. Most have since been swapped to ETH.

Duelbits (EVM):… pic.twitter.com/VwC0hCZ35F

— Scam Sniffer | Web3 Anti-Scam (@realScamSniffer) September 24, 2026

Hot wallets remain connected to online infrastructure, so platforms can process customer deposits, withdrawals and other transactions quickly. That accessibility makes them operationally useful but more exposed to attackers than offline cold-storage wallets.

The movement of assets from several networks within a short period suggests the attacker may have gained broad access to Duelbits’ wallet infrastructure rather than exploiting a vulnerability in one blockchain.

Scam Sniffer said the transaction pattern indicated a possible private-key compromise. Duelbits has not confirmed the cause.

A private key gives its holder control over the assets stored at the associated blockchain address. If the key is stolen, an attacker can sign transactions that appear valid to the network, even though the wallet’s legitimate owner did not authorize them.

Blockchain records show that an address labeled as a Duelbits Ethereum hot wallet transferred several assets to the suspected attacker within minutes.

The outgoing funds included 836 ETH, approximately 593,000 USDT, 97,000 USDC, 31,500 DAI, and 12.4 billion Shiba Inu tokens.

After the transfers, the wallet held less than $25 worth of ether.

The rapid movement across several assets is consistent with an attacker attempting to empty an operational wallet before the platform can identify the breach and restrict access.

Onchain labels are based on information collected by blockchain explorers and analytics services. Although the wallet is identified as belonging to Duelbits and the company has confirmed a hack, the precise ownership and role of every affected address may become clearer through the investigation.

Additional losses occurred on other networks, including the reported 8.1 BTC taken from the company’s Bitcoin hot wallet.

Duelbits has not published a complete breakdown showing how the approximately $7 million total was distributed across Ethereum, BNB Chain, Tron, and Bitcoin.

Stolen Assets Converted Into Ether

Most of the stolen tokens were subsequently exchanged for ether and consolidated into one newly created address.

The wallet held approximately 2,234 ETH, valued at roughly $6 million, at the time of publication. The funds had not moved onward.

Attackers commonly convert stolen assets into a blockchain’s native token because stablecoin issuers may be able to freeze USDT or USDC held in identified addresses. Consolidating the proceeds can also simplify later attempts to move or launder the funds.

Turning several tokens into ETH does not make the assets impossible to track. Every transaction remains visible on Ethereum, allowing security firms, exchanges, and law-enforcement agencies to monitor the wallet.

Public visibility does not guarantee recovery, however. The attacker could attempt to distribute the ether across several addresses, move it through decentralized services or bridge it to other blockchain networks.

The fact that the consolidated funds had not yet moved could give investigators time to notify exchanges and service providers. Whether any of the assets can be frozen or recovered will depend on where they are sent next and whether the involved parties can identify the attacker.

Duelbits Says User Funds Are Safe

“Confirming a ~$7M hack. Still investigating exactly what happened and how,” Duelbits co-founder Joe wrote on X.

He added that user funds were safe and said the site would remain unavailable until the investigation concluded and the affected wallets were refilled.

Duelbits separately described the breach as a “security incident” and said taking the platform offline was a precaution.

The company has not explained how it is separating customer assets from operational funds or what reserves it will use to replace the stolen cryptocurrency.

Its claim that customer balances remain safe suggests Duelbits expects to absorb the loss rather than pass it on to users. Customers will nevertheless need to wait for additional information about withdrawals and the platform’s financial position.

A complete incident report would ideally identify the compromised systems, explain whether other wallets were exposed, and describe the security measures introduced before the platform reopens.

The apparent attack method resembles the compromise suffered by Stake, the world’s largest crypto casino by trading volume, in 2023.

Attackers stole approximately $40 million from Stake after gaining access to private keys associated with its hot wallets.

A similar cause at Duelbits would raise questions about how the company stored signing credentials and whether access was sufficiently separated across employees, systems and blockchain networks.

Using multisignature wallets, transaction limits and independent approval systems can reduce the ability of one compromised credential to empty a wallet. 

Real-time monitoring can also help platforms stop suspicious transactions before losses spread across several networks.

The investigation has not yet established whether Duelbits had those controls or how the attacker may have bypassed them.