Duelbits Hot Wallet Hack: What It Means for Players

Duelbits put its loss at about $7 million from its hot wallets on 24 September 2026 (on-chain trackers counted about ~$4.9 million), went offline for three days, and has been taking deposits and paying out again since 27 September.[1] Nearly four weeks later no recovery has been announced and Duelbits has not said how the attacker got in. Here’s what happened and what it means if you have a balance there.

What Happened in the Duelbits Hack

On 24 September, Duelbits’ hot wallets on Ethereum, BNB Chain and Tron sent funds to newly created addresses. On-chain security firm Scam Sniffer flagged the outflows the same day, called it a suspected private-key compromise, and listed what moved: 836 ETH, 1.62 million USDT, 97,000 USDC, 209 BNB and 192,000 TRX, plus 8.1 BTC from the Bitcoin hot wallet. Most of it was swapped to ETH and gathered into one address holding about 2,234 ETH.[3]

Duelbits co-founder Joe confirmed the loss on X: “Confirming a ~$7M hack. Still investigating exactly what happened and how.” He said the site would stay offline until the team had clarity, and that “user funds are safe.”[2] That last part is the company’s statement, and Duelbits has not confirmed Scam Sniffer’s private-key theory.

Three days later, on 27 September, Duelbits announced it was back. Its post says deposits and withdrawals are live and that it relaunched with “around $8M across hot and cold wallets, ready to pay out.”[4]

The stolen ETH didn’t stay put. The address that held the consolidated 2,234 ETH now shows a near-zero balance on Etherscan, after outgoing transfers that include one of 1,011.55 ETH.[6] On 17 October Joe posted that “some funds” had been frozen “on some websites / exchanges,” and publicly offered the attacker a deal: send back $5 million, keep $2 million.[5] No recovery had been announced as of 20 October.

What It Means If You Play at Duelbits

If your balance sat on Duelbits during the outage, Duelbits’ position is that player balances were not touched by the hack. The practical test is simple: check that your balance matches what you had before 24 September, and make a small withdrawal to confirm payouts go through.

The one step you must not skip is the deposit address. Duelbits changed its deposit addresses with the relaunch and told players to “always get your new one from your account.”[4] If you saved an old Duelbits address in your exchange or wallet, delete it. Crypto sent to an address the casino no longer controls may simply be gone, and no support ticket can bring it back.

A few habits that make sense right now:

• Copy a fresh deposit address from the cashier every time, not from your address book.
• Don’t leave more on the site than you’re actively playing with. Hot wallets are the part of a casino that pays withdrawals, which is exactly why they’re targeted.
• If a withdrawal stalls, keep the transaction ID and timestamps, and contact live support before assuming the worst. Our guide to withdrawing crypto from a casino walks through what normal processing looks like.
• Watch Duelbits’ own X account for any update on the investigation or recovery, not reposts on third-party sites.

What Our Duelbits Review Says

This isn’t Duelbits’ first hot wallet loss. Blockchain security firm Halborn recorded a $4.6 million drain from Duelbits’ hot wallet in February 2024.[7] Two incidents of the same kind in under three years is now part of our Duelbits review, in the Trust & Reputation section and in the cons.

What the hack doesn’t change is the rest of the picture there: a Curaçao license that checks out as Active, crypto withdrawals Duelbits describes as instant, and no documents needed at sign-up. What it adds sits alongside a caution the review already carried: AskGamblers lists large withdrawals stuck in compliance review with none of its tracked complaints resolved. Taken together, the review’s advice stands, now with more weight behind it. Modest balances for active play look fine. Keeping a large bankroll parked at Duelbits carries risk that a fast relaunch doesn’t erase, at least until the company explains what went wrong.