On September 24, 2026, crypto casino Duelbits took its site offline after attackers drained its hot wallets on Ethereum, BNB Chain, Tron and Bitcoin. Cofounder Joe confirmed a hack of about $7 million, while blockchain security firms tracked between $4.2 million and $6 million depending on which chains they counted. It is the second time Duelbits has lost millions from its hot wallets, after a $4.6 million drain in February 2024.
This time the drained Ethereum wallet is the same address Duelbits announced as its new hot wallet after that 2024 hack. The Tanzanite data behind our Crypto Casino Market Report adds a second marker: across the wallets it tracks for Duelbits, the balance fell about 58% on September 24 to $607K, its lowest level in four weeks.
Duelbits says user funds are safe, the same assurance it gave after the 2024 breach, but it has published no proof of reserves and no root cause. As of September 25, the site is still offline and the official statement the cofounder promised has not appeared. Below is what is confirmed, where the money went, and what players should do now.
| Detail | What We Know |
|---|---|
| Date | September 24, 2026 |
| Reported loss | About $7M (Duelbits estimate); $4.2M to $6M (security firm snapshots) |
| Chains affected | Ethereum, BNB Chain, Tron, Bitcoin |
| Suspected cause | Private key compromise (security firms' view, not confirmed by Duelbits) |
| Previous hack | February 2024, about $4.6M |
| Tracked balance | $1.43M on September 23, $607K on September 24 (Tanzanite) |
| Site status | Offline since September 24 |
| Player funds | Duelbits says safe; no proof of reserves published |
| Operator | Liquid Entertainment N.V., Curacao (CGA license OGL/2024/1507/0838) |
What Duelbits Has Confirmed
Duelbits' first public word came at 11:42 UTC on September 24, nearly three hours after the first funds left its wallets and almost two hours after Scam Sniffer's first public alert. The post called it a “security incident” and gave no loss figure and no cause.
We're currently investigating a security incident affecting the site. As a precaution, the site has been taken offline while we investigate and work to ensure it is safe to restore service.
Duelbits (@Duelbits) September 24, 2026
The Cofounder's Statement on X
At 13:38 UTC, cofounder Joe put a number on it. He confirmed a hack of about $7 million and said the site would stay offline until the team understood what happened. Two minutes later, CEO Jasper posted that user funds were safe.
Confirming a ~$7M hack. Still investigating exactly what happened and how. Until we have clarity, Duelbits stays offline. User funds are safe. Next steps: finish the investigation, re-top hot wallets, and bring Duelbits back online, launch Duelbits 2.0. I'll keep posting updates as I have them.
Joe (@DuelbitsJoe) September 24, 2026
At 22:38 UTC the same day, Joe said Duelbits had identified what happened and would publish an official statement within 24 hours. He estimated the site would be back within about 15 hours and said the deposit and withdrawal servers were being rebuilt.
At 11:21 UTC on September 25, Duelbits posted that it was still offline while it finished final security checks.
Quick update: we're still offline while we finish our final security checks. We're not reopening until everything is fully secure.
Player funds remain safe. A more detailed update is coming very soon.
Thanks for your patience and your support. We'll be back.
Duelbits (@Duelbits) September 25, 2026
Joe's 15 hour estimate passed about two hours later with the site still down. The post again said player funds were safe and promised a more detailed update, but gave no reopening date.
What Duelbits Has Not Said Yet
At the time of writing, the official statement has not appeared and the site is still offline. That leaves the questions players care about most unanswered:
- How the attacker got in. A private key compromise is the security firms' theory, not a confirmed cause.
- The full loss by chain. The ~$7M figure comes with no breakdown.
- Whether player deposits sat in the drained wallets. Duelbits has not said.
- Proof behind "user funds are safe". No proof of reserves or balance snapshot has been published.
- When withdrawals reopen. No date has been given.
- Law enforcement. After the 2024 breach, Duelbits said it had alerted law enforcement. It has not said so this time.
How the Duelbits Hack Unfolded
The on chain record shows how fast it happened. The first identified transfer left a Duelbits wallet on Tron at 08:58 UTC, and the Ethereum hot wallet was emptied in under three minutes. Blockchain monitors spotted the outflows before Duelbits said anything.
| Time (UTC) | Source | What Happened |
|---|---|---|
| 08:58 | On chain, Tron | 476,058 USDT leaves a wallet Scam Sniffer flagged as Duelbits' |
| 08:59 | On chain, BNB Chain | 552,762 USDT leaves the 2024 replacement wallet |
| 09:00 to 09:03 | On chain, Ethereum | 593,430 USDT, 96,805 USDC, 31,515 DAI and 12.4 billion SHIB leave the same wallet, then 836 ETH at 09:02:47 |
| 09:42 | On chain, Bitcoin | 8.1 BTC reaches an address flagged by researchers |
| 09:52 | Scam Sniffer | First public alert, about $4.2M, suspected private key compromise |
| 10:15 | PeckShield | Flags about $4.3M on Ethereum and BNB Chain |
| 11:36 | Scam Sniffer | Adds the 8.1 BTC and raises its estimate to about $4.9M |
| 11:42 | CertiK and Duelbits | CertiK flags about $6M; Duelbits takes the site offline |
| 13:38 | Joe, cofounder | Confirms a hack of about $7M |
| 13:40 | Jasper, CEO | Says user funds are safe |
| 22:38 | Joe, cofounder | Says Duelbits has identified what happened; promises a statement within 24 hours |
| September 25, 11:21 | Duelbits | Still offline for final security checks; says player funds remain safe |
The Bitcoin transaction drew on several input addresses, so the public record alone does not prove that all 8.1 BTC came from Duelbits. The other transfers come from wallets that security firms and Duelbits' own 2024 announcement tie to the casino.
What the timing shows: every identified transfer out of Duelbits' wallets was complete before the first public alert at 09:52 UTC. That speed and scale is why Scam Sniffer suspects a leaked private key rather than a software bug.
Where the Stolen Funds Went
Most of the stolen tokens were swapped into ETH within hours and moved to a single new address. As of September 25, that address held about 2,334 ETH, roughly $6.3 million at the September 25 ETH price, and had sent nothing since September 24. The drained Duelbits hot wallet was left with about $25.
Swapping into ETH is a common move after a hack. Tether and Circle can freeze USDT and USDC held at a flagged address, but no issuer can freeze ETH. Researchers also note that the consolidation address received funds from other sources, so not every coin in it can be counted as Duelbits' loss.
Wallet Addresses in the Duelbits Hack
These are the addresses tied to the September 24 transfers. Every transaction on them is public and can be checked on the block explorers linked below.
| Wallet | Address | Role |
|---|---|---|
| Duelbits hot wallet (Ethereum, BNB Chain) | 0x014435B1E39945CF4f5F0c3cbb5833195A95CC9B | Sender. Announced by Duelbits as its new ETH hot wallet on February 15, 2024. Now holds about $25. |
| First recipient (Ethereum) | 0xA77e24Fe29d16E051e487ef4Ea7b056cb05aef76 | Received 836 ETH, 593,430 USDT, 96,805 USDC, 31,515 DAI and 12.4 billion SHIB |
| Consolidation address (Ethereum) | 0x8dB9D7f0a03d212c566Ca80c66e294CeCC20C306 | Holds about 2,334 ETH. No outgoing transfers since September 24. |
| Tron recipient | TAvraZZFCZbDSZoyqWWRRsBkFgZqKaCGbK | Flagged as a theft address by on chain analyst Specter |
| Bitcoin recipient | bc1qhtu84kz3y94lvgl2t05zk84tqh57grvd82zvcl | Flagged as a theft address by Specter |
Why the Reported Loss Figures Differ
Headlines have quoted everything from $4.2 million to $7 million. The gap is not a contradiction, because each figure measured something different:
- Different chains. PeckShield counted Ethereum and BNB Chain only. Scam Sniffer included Tron from the start and added Bitcoin later.
- Different times. Estimates came out between 09:52 and 13:38 UTC as more transfers were found.
- Different prices. Token values moved during the day, so the same coins were worth different amounts in each snapshot.
- No breakdown from Duelbits. The ~$7M figure is the operator's own and comes without a chain by chain reconciliation.
USDT shows the gap clearly. The Ethereum and BNB Chain transfers add up to 1,146,192 USDT, the figure PeckShield reported, and adding the Tron transfer brings it to 1,622,250 USDT.
Duelbits Deposits and Balance Before the Hack
We track Duelbits every month for our market report, using Tanzanite data on the wallets it attributes to each operator. The daily figures for the week of the hack show two things: deposits did not slow before the hack, and the tracked balance fell sharply on September 24.
| Date | Deposit Volume | Tracked Balance |
|---|---|---|
| September 18 | $787K | $1.26M |
| September 19 | $631K | $1.42M |
| September 20 | $1.86M | $1.61M |
| September 21 | $654K | $1.64M |
| September 22 | $622K | $1.36M |
| September 23 | $1.02M | $1.43M |
| September 24* | $316K | $607K |
*Partial day. Duelbits took the site offline around 11:42 UTC. Source: Tanzanite daily timeseries, VIP-Grinders analysis. Tanzanite's live snapshot, used in our monthly market report, measures balances differently and reads higher.
- No slowdown in deposits. Players deposited $5.57M between September 18 and 23, and September 23 was the second highest day of the week at $1.02M.
- The balance fell about 58% on hack day. It dropped from $1.43M on September 23 to $607K on September 24.
- Lowest level in four weeks. $607K is less than half the lowest balance of the previous six days, and the lowest Tanzanite recorded for Duelbits since August 28.
Why these numbers are smaller than the theft: the reported loss of $4.2M to $7M is larger than Duelbits' tracked balance on any day that week. Tanzanite does not cover every Duelbits wallet, so the drop shows the hit to the wallets it tracks, not the full theft.
Watching for the Hot Wallet Refill
Joe's recovery plan includes refilling the hot wallets before the site reopens. If the new funds go to wallets Tanzanite tracks, the balance should jump, which would be the first on chain sign that Duelbits has put fresh money in. We will add the daily figures here as they come in.
Has Duelbits Been Hacked Before?
Yes. On February 13, 2024, an attacker drained about $4.6 million from Duelbits wallets on Ethereum and BNB Chain. CertiK flagged a possible private key compromise at the time, and De.Fi's incident report put the loss at $4,643,315.
Two days later, Duelbits posted this statement on X:
Dear Duelbits Community,
In response to the recent posts, we wish to assure everyone that all Duelbits customer funds and accounts are safe and secure.
Our ETH hot wallet recently experienced a security breach, resulting in the unauthorized withdrawal of a small amount of our ETH reserve (~1700 ETH). We have alerted law enforcement and are working hard to address the situation.
However, we want to reassure the Duelbits community that the security of user accounts has not been compromised and remains our highest priority.
Despite this unfortunate incident, all our services continue to operate smoothly and without interruption.
Funds are Safu
Duelbits (@Duelbits) February 15, 2024
In the next post of the same thread, Duelbits named its new ETH hot wallet: 0x014435B1E39945CF4f5F0c3cbb5833195A95CC9B. That is the address drained on September 24, 2026. Etherscan shows the wallet was first funded in February 2024, around the time of that announcement.
The Two Duelbits Hacks Compared
| Detail | February 2024 | September 2026 |
|---|---|---|
| Loss | About $4.6M | About $7M (Duelbits estimate) |
| Chains | Ethereum, BNB Chain | Ethereum, BNB Chain, Tron, Bitcoin |
| Suspected cause | Possible private key compromise (CertiK) | Suspected private key compromise (Scam Sniffer) |
| Wallet drained | Duelbits' ETH reserve hot wallet | The replacement hot wallet announced after 2024 |
| What Duelbits said about funds | Customer funds and accounts “safe and secure” | “User funds are safe” |
| Law enforcement | Alerted, according to Duelbits | Not mentioned so far |
| Service | Continued “without interruption” | Site taken offline |
What a private key compromise means: a hot wallet is controlled by a private key, and whoever holds that key can sign transfers out of it. No software bug is needed and the blockchain treats every transfer as valid, which is why a wallet can be emptied in minutes.
What Duelbits' Own Website Says
A page on Duelbits' blog titled “Is Duelbits Legit?”, published on April 5, 2026, says the casino “has operated without a security breach since 2020”. Here is how its claims compare with the record:
| What the Page Says | What the Record Shows |
|---|---|
| No security breach since 2020 | Duelbits itself reported a hot wallet security breach on February 15, 2024 |
| Operated by Liquid Gaming N.V. under license GLH-OCCHKTW076092020 | The page's own footer names Liquid Entertainment N.V., which holds CGA license OGL/2024/1507/0838 |
| Reserves cover all player balances | No proof of reserves has been published |
Is Duelbits Safe Right Now?
Right now, nobody outside Duelbits can say. The site is offline, withdrawals are unavailable, and the only evidence that player balances are intact is the company's own word.
Are Duelbits User Funds Safe?
Duelbits says yes, in posts from Joe and CEO Jasper and on its own blog. But it has published no proof of reserves, no balance snapshot and no plan for processing withdrawals.
Balances on Duelbits are custodial. Deposits are converted into the platform's own “Bits”, so the number in your account is a claim on Duelbits, not coins sitting in a wallet you control.
What would actually prove it: a proof of reserves, meaning published wallet addresses holding enough to cover every player balance, or withdrawals processing normally once the site returns. Until one of those happens, “user funds are safe” is a statement, not evidence.
Is Duelbits Down? Withdrawals and Reopening
Yes: the casino has been offline since September 24, and deposits and withdrawals are unavailable. Joe's estimate of a return within about 15 hours has passed, and Duelbits' September 25 update said only that it would reopen once everything was fully secure. When the site comes back, the real test is whether withdrawals go through, not whether the site loads.
What the Curacao License Covers
Duelbits is operated by Liquid Entertainment N.V. under Curacao Gaming Authority license OGL/2024/1507/0838, which can be checked on the CGA register. A license tells you which registered company is accountable, which is what separates Duelbits from unlicensed sites. It does not audit the crypto behind each player balance.
What Duelbits Players Should Do Now
If you have funds on Duelbits, these steps protect you while the site is down:
- 1Gather your records. Save your deposit and withdrawal transaction IDs and any emails that show your balance, so you have your own proof if a dispute comes up.
- 2Use official channels only. Follow updates from @Duelbits and @DuelbitsJoe on X, not from accounts that message you first.
- 3Ignore refund and recovery offers. Scammers target players after every public hack. No real support agent will ask for your seed phrase, password or 2FA code.
- 4Keep only what you play with on site. Once withdrawals reopen, holding the rest in a wallet you control removes your exposure to the next incident.
If you want to play elsewhere while Duelbits is offline, start with the crypto casinos we have tested with real money.
How the Duelbits Hack Compares to Other Crypto Casino Hacks
Duelbits is not the first crypto casino to lose millions to hackers. It is the only operator in this table to be hit twice.
| Casino | Reported Loss | How It Happened | What Happened Next |
|---|---|---|---|
| Stake.com (September 2023) | About $41M | Breach of a service used to authorize transactions; the FBI attributed it to North Korea's Lazarus Group | Said user funds were safe; affected wallets were back within hours |
| Duelbits (February 2024) | About $4.6M | Possible private key compromise | Said funds were safe; services continued |
| MetaWin (November 2024) | Over $4M | Exploit of its withdrawal system | CEO said he covered the losses personally; withdrawals re-enabled for most users |
| BC.GAME (March 2026) | $4.3M | Vulnerability in a third party game | Stayed online; $500K bounty offered |
| Duelbits (September 2026) | About $7M | Suspected private key compromise | Site offline; no root cause published yet |
Most of these incidents came down to wallet access. Attackers breached the system Stake used to authorize transactions, security firms suspect a key compromise at Duelbits both times, and MetaWin lost funds through its withdrawal system. The exception was BC.GAME, which lost $4.3 million through a third party game in March.
What separates them is the response. Stake had its affected wallets running again within hours, BC.GAME stayed online and posted a bounty, and MetaWin's CEO said he covered the losses himself. Duelbits took its site offline and, at the time of writing, has not explained how the attacker got in.
Why hot wallets keep getting hit: casinos keep enough crypto online to pay withdrawals instantly. The faster the payouts, the more money has to sit in wallets whose keys live on internet connected systems.
What Happens Next
This story is still developing. These are the things to watch:
- The detailed update. Joe promised an official statement within 24 hours of his September 24 post, and Duelbits said on September 25 that a more detailed update was coming very soon. It should explain how the attacker got in and which systems were hit.
- The reopening. Watch whether withdrawals process at normal speed once the site returns, and whether any new limits apply.
- The hot wallet refill. A jump in Duelbits' tracked balance would be the first on chain sign of fresh funds. We will update the figures above as they come in.
- The stolen ETH. About 2,334 ETH sits in one address. If it moves to an exchange, that exchange could freeze it.
- Attribution. No investigator or law enforcement agency has named the attacker yet.
- What Duelbits 2.0 changes. Joe has promised a relaunch but has not said what changes in custody or security.
We will update this article as new details emerge.
Duelbits is not Duel.com: the names are similar, but they are separate casinos with different owners. Duel.com is run by Immortal Snail LLC under an Anjouan license and has not been reported as affected by this hack. Our Duel Casino review covers it in full.
FAQs
What happened in the Duelbits hack?
On September 24, 2026, attackers drained Duelbits hot wallets on Ethereum, BNB Chain, Tron and Bitcoin, and the crypto casino took its site offline. Cofounder Joe confirmed a hack of about $7 million. Security firms suspect a private key compromise, but Duelbits has not confirmed the cause.
How much was stolen in the Duelbits hack?
Duelbits cofounder Joe put the loss at about $7 million. Security firms published lower snapshots between $4.2 million and $6 million, because each counted different chains at different times. Duelbits has not released a breakdown by chain.
Is Duelbits down?
Yes. Duelbits has been offline since September 24, 2026, and deposits and withdrawals are unavailable. Cofounder Joe's estimate of a return within about 15 hours has passed, and on September 25 Duelbits said it would not reopen until everything was fully secure.
Are Duelbits user funds safe?
Duelbits says user funds are safe, but it has not published a proof of reserves, a balance snapshot or a withdrawal plan. Balances on Duelbits are custodial, so players cannot verify their funds until withdrawals work again.
Has Duelbits been hacked before?
Yes. In February 2024 an attacker drained about $4.6 million from Duelbits wallets on Ethereum and BNB Chain. After that breach, Duelbits announced a new ETH hot wallet, and that same address was drained in the September 2026 hack.
Where did the stolen Duelbits funds go?
Most of the stolen tokens were swapped into ETH and moved to a single address, which held about 2,334 ETH on September 25, 2026. That address had sent nothing since September 24. Swapping stablecoins into ETH stops Tether or Circle from freezing them.
Is Duelbits licensed?
Duelbits is operated by Liquid Entertainment N.V. under Curacao Gaming Authority license OGL/2024/1507/0838. A license shows which company is accountable, but it does not audit the crypto behind player balances.
Is Duelbits the same as Duel.com?
No. Duelbits and Duel.com are separate casinos with different owners. Duel.com is run by Immortal Snail LLC under an Anjouan license and has not been reported as affected by the Duelbits hack.
