Crypto Casino Hacks Tracker: Thefts and Breaches Since 2013
Crypto gambling platforms, from casinos and sportsbooks to the payment processors that serve them, have lost at least $132 million to hackers since 2013 in the 18 thefts and exploits documented on this page. Four more incidents were data breaches, the largest exposing 96.2 million 1win accounts. Roughly three quarters of the money went in three 2023 attacks that the FBI attributed to North Korea’s Lazarus Group.
Since 2024 the thefts have been smaller, between $2 million and $7.5 million each, and most were drained from hot wallets, the wallets a casino keeps online to pay withdrawals. Several incidents came through outside suppliers instead, such as a game provider, a CRM firm and an analytics firm. Duelbits and Gamdom were hacked within three weeks of each other in September and October 2026.
VIP-Grinders has covered online poker since 2013 and crypto casinos since 2024, and we now report each new incident as it happens. This tracker brings the documented cases together in one place. Where an operator’s own figure differs from what investigators traced on chain, both are shown.
The tracker covers four things.
- The incident table: thefts, exploits and data breaches since 2013 and their totals, newest first.
- The totals: how much was stolen each year, and who was behind the biggest attacks.
- Each incident: how it happened, how the operator responded and whether player funds were affected.
- Your own funds: what a hack means for your balance, and how to limit the risk.
Which Crypto Casinos Have Been Hacked?
The table below lists the documented incidents, newest first, with US dollar amounts at the time of each one. Where sources disagree, both figures are shown with who gave each one. Each incident is covered in more detail in the sections that follow.
Total stolen across the 18 thefts and exploits: at least $132 million, and up to about $175 million on the higher figures.
| Date | Platform | What Happened | Amount | Response |
|---|---|---|---|---|
| 13 Oct 2026 | Gamdom | Hot wallets drained after an unauthorized server connection | Just over $3M (Gamdom); about $4.2M traced on chain | Offline until 16 Oct; says user funds are safe |
| 24 Sep 2026 | Duelbits | Hot wallets drained; private key compromise suspected, not confirmed | About $7M (Duelbits); about $6M traced on chain | Offline until 27 Sep; says user funds are safe |
| 5 Mar 2026 | BC.Game | Exploit of a third party game | $4,326,700 (BC.Game) | $500K bounty; site stayed online |
| Nov 2025 (notice Dec 2025) | Stake | User data exposed at analytics provider Mixpanel | Usernames, emails, dates of birth, phone numbers | Says funds and passwords are secure |
| 10 Oct 2025 | Shuffle | Data breach at CRM provider Fast Track | Names, emails, home addresses, transaction and betting history | Says funds, passwords and logins were not affected |
| 10 Oct 2025 | Roobet | Same Fast Track breach | Under review by Roobet | Says accounts, passwords, wallets and funds are safe |
| Nov 2024 | CoinPoker | Hot wallet drained in 82 transfers | About $2M | Offered the attacker a bounty to return the funds |
| 3 Nov 2024 | MetaWin | Hot wallets drained through a flaw in the withdrawal system | About $4M | CEO says losses were topped up, partly from his own funds |
| Nov 2024 | 1win | Database breach and extortion attempt | 96.2M accounts: emails, phones, IP addresses, dates of birth, hashed passwords | Refused ransom demands of $1M, then $15M |
| 13 to 14 Feb 2024 | Duelbits | Hot wallet drained; possible private key compromise (CertiK) | About $4.6M | Said customer funds were safe; services kept running |
| 25 to 30 Jan 2024 | Gamdom | Dice bug skipped the nonce on 0.8% of bets | $104,124 refunded to players | Fixed in two days; losses repaid in full |
| 5 Jan 2024 | CoinsPaid | Funds drained at the payment processor | About $7.5M (Cyvers); €4.08M in CoinsPaid’s accounts | No public statement at the time |
| 4 Sep 2023 | Stake | Hot wallets drained on ETH, BSC and Polygon; FBI attributed it to Lazarus | About $41M | Says user funds are safe |
| Sep 2023 | Dice9win | Malicious contracts placed bets that could not lose | $25K taken; $200K saved | Funds pulled and contract patched |
| 5 to 6 Sep 2023 | GMBL.COMPUTER | Flaw in bet signing and referral rewards exploited | About 500 ETH ($770K to $800K) | Half recovered; bounty offered |
| 22 to 23 Jul 2023 | Alphapo | Hot wallets drained at the payment processor; FBI attributed it to Lazarus | $23M first reported; over $60M traced by ZachXBT | Clients including HypeDrop paused withdrawals |
| 22 Jul 2023 | CoinsPaid | Hot wallet hack at the payment processor; FBI attributed it to Lazarus | $37.3M (CoinsPaid) | Says client funds were not affected |
| 30 Nov 2022 | Dexsport | Flaw in the deposit system let attackers credit their own balances | 400,000 BUSD of platform liquidity | Patched within hours; says user funds were not affected |
| Sep 2019 | EOSPlay | Game randomness manipulated by flooding the network | About 30,000 EOS (about $110K) | No response reported |
| Oct 2018 | EOSBet | Second smart contract exploit | About 65,000 EOS (about $338K) | Patched |
| 14 Sep 2018 | EOSBet | Fake transfers used to place bets for free | 44,427 EOS (about $200K to $240K) | Taken offline; patched about a day later |
| Sep 2018 | DEOSGames | Smart contract exploit | About 4,400 EOS net (about $22K) | Confirmed; back online after contract changes |
| Aug 2014 | Primedice | A player exploited how the server seed was handled | More than 2,400 BTC (about $1M) | Funds not recovered |
| Dec 2013 | Seals with Clubs | Password database leaked through a former datacenter | 42,020 hashed passwords | No funds reported lost |
The gap between the two totals comes mostly from July 2023. The FBI put the combined theft from Alphapo and CoinsPaid at $60 million, which matches CoinsPaid’s $37.3 million plus Alphapo’s first count of $23 million, while ZachXBT later traced over $60 million from Alphapo alone.
Data breaches are listed in the table but not counted in the totals, because no money was taken. The Gamdom dice bug is not counted either: Gamdom repaid every player who lost money because of it.
How Much Has Been Stolen From Crypto Casinos?
At least $132 million has been stolen from crypto gambling platforms and their payment processors in the thefts on this page. One year accounts for most of it: 2023, when three attacks on Stake and two payment processors took between $101 million and $138 million. No theft is recorded here for 2025, the only year since 2022 without one.
The table gives both totals for each year, with data breaches noted where a year had no thefts. Amounts are in US dollars at the time of each incident.
| Year | Thefts and Exploits | Stolen, Lowest Figures | Stolen, Highest Figures |
|---|---|---|---|
| 2013 | None (data breaches only) | $0 | $0 |
| 2014 | 1 | $1.0M | $1.0M |
| 2018 | 3 | $0.6M | $0.6M |
| 2019 | 1 | $0.1M | $0.1M |
| 2022 | 1 | $0.4M | $0.4M |
| 2023 | 5 | $101.8M | $139.1M |
| 2024 | 4 | $15.0M | $18.1M |
| 2025 | None (data breaches only) | $0 | $0 |
| 2026 | 3 | $13.3M | $15.5M |
| Total | 18 | $132.2M | $174.9M |
The 2024 and 2026 totals are similar, at $15 million to $18 million and $13 million to $16 million, but each year was spread across three or four smaller incidents rather than one large one.
Who Was Behind the Biggest Hacks
On 6 September 2023 the FBI named North Korea’s Lazarus Group as the attacker behind the Stake theft, and said the same group had taken about $60 million from Alphapo and CoinsPaid in July. By then, the FBI said, the group had stolen more than $200 million in crypto that year across all its targets. Those three gambling attacks alone account for about three quarters of the money on this page.
- Stake: about $41 million from hot wallets on ETH, BSC and Polygon, on or about 4 September 2023.
- CoinsPaid: $37.3 million on 22 July 2023, in an attack the company itself suspected was Lazarus.
- Alphapo: first reported at $23 million on 22 and 23 July 2023, later traced by ZachXBT at over $60 million.
No other attacker on this page has been publicly identified. On chain investigators such as ZachXBT trace where stolen funds go, and linked more than 115 addresses to the MetaWin attacker.
How Crypto Casino Hacks Have Changed
The early thefts were players finding flaws in game code. The biggest thefts came in 2023, from hot wallets, and since 2024 the thefts have been smaller, with several breaches coming through suppliers rather than the casinos themselves.
| Period | Main Type of Attack | Examples |
|---|---|---|
| 2014 to 2019 | Flaws in game code and smart contracts, found and used by players | Primedice, EOSBet, DEOSGames, EOSPlay |
| 2022 to 2023 | Three large hot wallet thefts, all attributed by the FBI to North Korea, alongside smaller code exploits | Stake, CoinsPaid, Alphapo; Dexsport, GMBL.COMPUTER, Dice9win |
| 2024 to 2026 | Smaller hot wallet drains, plus incidents that came through outside suppliers | Duelbits, MetaWin, CoinPoker, Gamdom; BC.Game, Shuffle, Roobet, Stake |
Most of the money stolen since 2023 came out of hot wallets, the wallets a casino keeps online to pay withdrawals. When a hot wallet is drained, the casino has to cover the loss from its own reserves.
Crypto Casino Hacks and Exploits
This section covers thefts from the casinos, sportsbooks and poker rooms themselves, newest first. Payment processor hacks, data breaches and on chain gambling apps follow in their own sections.
Gamdom Server Breach (2026)
Gamdom went offline on 13 October 2026 after staff checking a suspected disk failure found an unauthorized connection on an automation server. Founder Felix Romer put the loss from its hot wallets at just over $3 million, while on chain investigator vxdb counted about $4.2 million. Gamdom has not explained the gap, and our Gamdom hack coverage follows the story as it develops.
- On chain breakdown: about $2.2 million on Ethereum compatible networks, $965,000 on Solana, $668,000 in bitcoin and $375,000 on Tron, by vxdb's count.
- Response: the remaining funds were moved to cold storage and Gamdom said user funds are safe.
- Status: back online on 16 October with a relaunch package of bonuses and leaderboards; the attacker has not been identified.
Duelbits Hacks (2024 and 2026)
Duelbits has been hacked twice. In February 2024 security firm CertiK reported about $4.6 million taken on Ethereum and BNB Chain in a possible private key compromise, and on 15 February Duelbits confirmed a breach of its ETH hot wallet and said customer funds were safe. On 24 September 2026 co-founder Joe confirmed “a ~$7M hack” and took the site offline, as covered in our report on the 2026 Duelbits hack.
- 2026 on chain figures: Scam Sniffer flagged outflows on Ethereum, BNB Chain and Tron plus 8.1 BTC, and about 2,234 ETH, worth roughly $6 million, was gathered in a single address.
- Cause: a private key compromise is suspected by researchers but has not been confirmed, and Duelbits has not published a root cause.
- Response: Duelbits said user funds are safe and came back online on 27 September with about $8 million across its hot and cold wallets.
- Not the same as Duel: Duelbits is run by Liquid Entertainment N.V. and launched in 2020; Duel (duel.com) is a separate company that launched in 2025.
BC.Game Third Party Game Exploit (2026)
On 5 March 2026 BC.Game said a hacker “exploited a vulnerability in a third-party game” and took $4,326,700. It offered a $500,000 bounty for information on the wallet and kept the site running, without naming the game or its provider. More detail is in our article on how the BC.Game exploit unfolded.
- What the attacker did next: used part of the money to open a short position of about $31 million on ETH, which lost around $1.5 million in liquidations.
- Response: a $500,000 public bounty, with deposits and withdrawals still processing normally.
- Status: the game and provider have not been named and the attacker has not been identified.
CoinPoker Hot Wallet Hack (2024)
In November 2024 CoinPoker’s hot wallet lost about $2 million in 82 transfers of $25,000 or less, made in 50 minutes on Ethereum, BNB Chain and Polygon. Security firm Cyvers said the cause was apparently a weakness at an outside provider that ran CoinPoker’s payment gateway. The funds were sent through the Tornado Cash mixer.
- Response: CoinPoker acknowledged the hack and sent the attacker an on chain message offering a bounty for the return of the funds.
- Player funds: we found no public statement from CoinPoker on whether player balances were affected.
- Status: the attacker has not been identified.
MetaWin Withdrawal System Hack (2024)
On 3 November 2024 an attacker drained about $4 million from MetaWin’s hot wallets on Ethereum and Solana. CEO Richard “Skel” Skelhorn said the attacker exploited a vulnerability in its “frictionless withdrawal system”, and MetaWin paused withdrawals while it investigated. ZachXBT linked more than 115 addresses to the attacker and traced funds to KuCoin and a service nested in HitBTC.
- Response: withdrawals were later restored for 95% of customers.
- Player funds: Skelhorn said the losses were topped up, partly from his own money.
- Status: the attacker has not been identified.
Stake Hot Wallet Hack (2023)
On or about 4 September 2023 attackers drained about $41 million from Stake’s hot wallets, roughly $16 million on Ethereum and $25.6 million on BSC and Polygon, according to Halborn. Two days later the FBI attributed the theft to North Korea’s Lazarus Group. Stake said user funds were safe and that its bitcoin, litecoin, XRP, EOS and TRX wallets remained fully operational.
- Response: deposits and withdrawals on the affected wallets were paused until they were secured again.
- Attributed to: the Lazarus Group, named by the FBI on 6 September 2023.
- Status: still the largest single theft from a crypto casino on this page.
Dexsport Deposit System Exploit (2022)
On 30 November 2022 attackers found that crypto betting platform Dexsport’s off chain system for recording deposits treated transaction IDs as case sensitive. They used that to credit their own balances and withdrew 400,000 BUSD from the platform’s own liquidity fund. Dexsport said the flaw was not in its smart contracts.
- Response: the flaw was closed within hours and extra security checks were added.
- Player funds: Dexsport said user funds were not affected, because the money came from its own liquidity.
- Status: fully restored within hours, in the middle of the 2022 World Cup.
Payment Processor Hacks
Many crypto casinos do not handle deposits and withdrawals themselves and use a payment processor instead. When a processor is hacked, the money taken usually belongs to the processor, but withdrawals can stall at the casinos that rely on it. The three processor hacks below account for between $64 million and $105 million of the money on this page.
CoinsPaid Hacks (2023 and 2024)
On 22 July 2023 payment processor CoinsPaid lost $37.3 million in a hack it said it suspected was the work of the Lazarus Group. It said client funds were not affected, and services came back one by one in a new, more secure environment.
CoinsPaid was hit again on 5 January 2024. Security firm Cyvers put the loss at about $7.5 million in USDT, USDC, ETH, BNB and CoinsPaid’s own CPD token, and CoinsPaid made no public statement at the time.
- Loss in the accounts: €4.08 million, according to FinTelegram's reading of CoinsPaid's 2024 management report.
- Recovered: €932,902, traced and returned to company accounts on 12 February 2025, per the same report.
- Attributed to: unclear; reports noted the attack resembled the 2023 one, but nobody has confirmed who was behind it.
Alphapo Hack (2023)
Alphapo, a payment processor used by gambling sites, had its hot wallets drained on 22 and 23 July 2023, the same weekend as CoinsPaid. First reports put the loss at $23 million and then over $31 million, before ZachXBT found about $37 million more taken on Tron and Bitcoin, bringing the total to over $60 million. He wrote that the hack “appears to likely have been done by Lazarus”.
- Gambling sites affected: HypeDrop, Bovada and Ignition, according to reports at the time.
- Player impact: HypeDrop disabled withdrawals, citing ongoing deposit and withdrawal issues.
- Attributed to: the Lazarus Group, named by the FBI alongside CoinsPaid in its 6 September 2023 statement.
A processor hack is not a hack of the casino, but it can still stop withdrawals at the sites that rely on it, as HypeDrop’s users found. Players often cannot tell which processor a casino uses, which is one more reason not to leave a large balance on any site.
Crypto Casino Data Breaches
Four of the incidents on this page were data breaches rather than thefts: no money was taken, but customer details were. The risks come afterwards.
- Phishing: emails and messages that use the leaked details to look like they come from the casino.
- Account takeover: attempts to log in with leaked passwords, at the casino and anywhere else they were reused.
- Identity documents: casinos that run KYC checks also hold ID and proof of address.
Our guide to the personal data casinos collect for KYC explains what casinos hold and why.
Stake Mixpanel Data Exposure (2025)
In December 2025 Stake emailed users to say some of their data had been exposed through Mixpanel, an analytics company it used. Mixpanel had detected an SMS phishing campaign against it on 8 November 2025, and an attacker gained access to part of its systems. The same breach hit other Mixpanel customers, including OpenAI.
- Data exposed: usernames, email addresses, dates of birth and phone numbers.
- Not exposed: passwords, login details and financial information, according to Stake.
- Stake's position: user funds and passwords remain secure.
Fast Track Breach at Shuffle and Roobet (2025)
On 10 October 2025 Shuffle co-founder Noah Dummett said a breach at Fast Track, the CRM company Shuffle used for emails and player communications, had impacted the majority of Shuffle’s users. Roobet, which also used Fast Track, disclosed the breach the same day. Fast Track said the attack specifically targeted two of its clients and had been stopped.
- Shuffle data exposed: names, email addresses, home addresses, and transaction and betting history.
- Shuffle's position: passwords, login details and player funds were not affected, because they were never stored with Fast Track, and Shuffle said it would look for alternatives to Fast Track.
- Roobet's position: it was still working with Fast Track to find out what data was affected, and said Roobet accounts, passwords, crypto wallets and funds are safe, as none of them were stored with Fast Track.
- Advice from both: watch for phishing emails and turn on two factor authentication.
1win Data Leak (2024)
In November 2024 a hacker using the name fe0dor posted a 1win customer database on the Exploit.in forum, and it was later shared for free on BreachForums. Have I Been Pwned lists 96.2 million affected accounts, by far the largest breach on this page. An official 1win Telegram channel confirmed that part of the database had been exposed.
- Data exposed: email and IP addresses, phone numbers, dates of birth, locations and SHA-256 hashed passwords.
- Extortion: the attackers asked for $1 million, then $15 million, to keep the data private, and 1win refused.
- 1win's position: its current infrastructure is secure.
- Check your own email: search for it on Have I Been Pwned, which added the 1win breach on 3 February 2025.
Seals with Clubs Password Leak (2013)
The earliest breach on this page hit Seals with Clubs, a bitcoin poker site, in December 2013. A database of 42,020 hashed passwords was posted online, and the site said the datacenter it had used until November had allowed unauthorized access to a database server. No bitcoin was reported stolen.
Provably Fair Bugs and On Chain Exploits
Provably fair games let you check every result yourself. The system works in four steps.
- Before you bet: the casino commits to a secret server seed by showing you its hash.
- Your input: you can set your own client seed, which the casino cannot know in advance.
- Each bet: a nonce, a counter that goes up by one with every bet, is combined with both seeds through a hash function such as HMAC-SHA256 to produce the result.
- Afterwards: when you switch to a new seed, the casino reveals the old server seed, and you can run the same calculation to confirm nothing was changed.
Our guide to how provably fair checks work walks through the full process. The two casino incidents below broke that system in opposite ways: one let a player see results in advance, and the other left some results impossible to check.
Gamdom Dice Nonce Bug (2024)
On 25 January 2024 a player reported that two nonces had been skipped on their Gamdom Dice account. Gamdom traced it to a security update from December 2023: when a bet failed, for example because the balance was briefly too low during autobet or with several tabs open, the bet was cancelled but the nonce still moved on. In total 161,214 of 20,038,866 Dice bets, or 0.8%, were affected.
- Effect on players: the odds and randomness were unchanged and Gamdom found the bug neutral for players on average, but nobody could verify the affected rolls.
- Fix: pushed on 27 January 2024 at 19:14 UTC, taking the stake from the balance before the nonce so a failed bet no longer uses one up.
- Repayment: every player whose affected bets added up to a loss was repaid in full on 30 January, $104,124.11 in total, and players who came out ahead kept their winnings.
- Disclosure: Gamdom credited the Provably Fair Foundation for reporting the bug and published the affected bets and repayments as CSV files.
On Chain Gambling Apps (2018 to 2023)
Gambling apps that run as smart contracts were exploited often in their early years, especially on the EOS network in 2018 and 2019. The cases below are examples rather than a complete list, as many small exploits of this kind were never widely reported.
- EOSBet, September 2018: a faulty check in the contract let an attacker trigger its transfer function directly, placing bets without depositing and collecting 44,427 EOS from winning bets. The game was taken offline and patched about a day later.
- EOSBet, October 2018: a second exploit tricked the contract into crediting the attacker's account, this time for about 65,000 EOS.
- DEOSGames, September 2018: an account called runningsnail deposited 339 EOS and took out more than 4,728 EOS in jackpots in under an hour.
- EOSPlay, September 2019: an attacker rented large amounts of network capacity to fill blocks with their own transactions, which let them manipulate the game's randomness and take about 30,000 EOS.
- GMBL.COMPUTER, September 2023: within a day of launch, an attacker took nearly 500 ETH from the on chain casino. The team first blamed a spoofed call to its signing server, and its later postmortem described fake bets that earned referral rewards. Half the funds were recovered.
- Dice9win, September 2023: malicious contracts let the attacker keep winning bets and cancel losing ones. Researchers from Seal 911 stopped it after $25,000 was taken, saving $200,000.
Primedice Seed Exploit (2014)
In August 2014 a player using the name Hufflepuff found that sending hundreds of requests in under a second made Primedice’s server reveal its active server seed, the one secret the casino keeps until the seed is changed. With it, the player could see the result of each bet before placing it. The player took more than 2,400 BTC, about $1 million at the time.
- Response: Primedice later published its own account of the exploit, titled Breaking the House.
- Recovered: nothing. A later workaround to an incomplete patch won more than 2,000 BTC again, but only 50 to 60 BTC could be withdrawn because the hot wallet had run dry.
What Happens to Your Funds When a Crypto Casino Is Hacked?
Your balance at a crypto casino is a number in the casino’s own records, not coins in a wallet with your name on it. Whether you are paid after a hack depends on the casino having enough left to cover the loss.
Hot Wallets and Cold Storage
Casinos like Stake keep most of their crypto offline in cold storage and only a working balance in hot wallets, which stay online so withdrawals can be paid quickly. After the 2023 hack, co-founder Ed Craven said Stake “keeps a small portion of its crypto reserves in hot wallets” for exactly this reason. Exchanges hold customer crypto the same way.
After their hot wallets were drained, these operators said the following about player funds.
- Stake, 2023: user funds are safe.
- MetaWin, 2024: the CEO topped up the losses, partly from his own money.
- Duelbits, 2026: user funds are safe, and the site reopened with about $8 million across its hot and cold wallets.
- Gamdom, 2026: user funds are safe, and the remaining funds were moved to cold storage.
Paying players in full works only while a casino holds enough reserves to absorb the loss, which is why our monthly market report tracks the hot wallet balances of 41 crypto casinos on chain.
What a Casino License Does and Does Not Cover
A license does not change who pays after a hack: in every incident on this page, any repayment came from the operator or its owners. What a license gives you is a route to complain if a casino will not pay, through the regulator or an independent dispute service. Our guide to what Curaçao, Anjouan and MGA licenses cover explains how each one handles complaints.
How to Protect Your Account and Balance
None of these steps can stop a casino being hacked, but they limit what a hack or a data breach can cost you.
- Keep only what you plan to play: deposit for the session and withdraw what is left, since crypto withdrawals are usually quick.
- Keep your savings in your own wallet: not on a casino or an exchange.
- Turn on two factor authentication: ideally with an authenticator app rather than SMS.
- Use a different password for every casino: so one leak cannot open your other accounts.
- Check Have I Been Pwned after a breach: and change any password you have used elsewhere.
- Be wary of messages after a breach: especially offers of compensation or links asking you to log in, and go to the casino's site directly instead.
VIP-Grinders’ own rule for crypto casinos is the simplest one.
Treat a crypto casino the way you would treat an exchange. Whatever you leave there is only as safe as the platform holding it, and your savings belong in your own wallet. Withdrawals are near instant, so deposit what you plan to play, play, and withdraw the rest.
Frequently Asked Questions
How many crypto casinos have been hacked?
VIP-Grinders has documented 18 thefts and exploits at 15 crypto gambling platforms since 2014, from casinos and sportsbooks to payment processors and on chain apps, plus four data breaches. Together the thefts took at least $132 million, and up to about $175 million on the higher figures. The most recent were Duelbits in September 2026 and Gamdom in October 2026.
What is the biggest crypto casino hack?
The largest theft from a crypto casino is the Stake hack of September 2023, when about $41 million was drained from its hot wallets on Ethereum, BSC and Polygon. The FBI attributed it to North Korea’s Lazarus Group. Payment processor Alphapo, which serves gambling sites, may have lost more, with ZachXBT tracing over $60 million taken in July 2023.
Was Stake hacked?
Yes: on or about 4 September 2023 attackers took about $41 million from Stake’s hot wallets, and two days later the FBI attributed the theft to North Korea’s Lazarus Group. Stake said user funds were safe. In December 2025 Stake also told users that some of their data had been exposed through a breach at its analytics provider Mixpanel.
Did players lose money when crypto casinos were hacked?
Several operators said player balances were safe after a hack: Stake, Duelbits and Gamdom all said user funds were safe, and MetaWin’s CEO said he topped up the losses partly from his own money. These are the operators’ own statements, and we found no public statement on player balances from others, including CoinPoker. The safest approach is to keep only what you plan to play at any casino.
What is a hot wallet hack?
A hot wallet is a crypto wallet a casino keeps online so it can pay withdrawals quickly, while the rest of its reserves are usually kept offline in cold storage. A hot wallet hack happens when attackers get control of that wallet, usually by stealing its private key or breaking into the system that sends withdrawals, and move the funds out. Most thefts from crypto casinos since 2023, including Stake, Duelbits, MetaWin and Gamdom, were hot wallet hacks.
Who is behind crypto casino hacks?
North Korea’s Lazarus Group is the only attacker publicly named by law enforcement: the FBI attributed the 2023 attacks on Stake, CoinsPaid and Alphapo to it, about three quarters of all the money stolen on this page. No other attacker has been publicly identified. Investigators such as ZachXBT, Cyvers and PeckShield trace where stolen funds go, but most cases remain unsolved.
What should I do if my crypto casino has a data breach?
Change your password at the casino and anywhere else you used it, turn on two factor authentication with an authenticator app, and check your email on Have I Been Pwned. Be wary of emails or messages that mention the breach, offer compensation or ask you to log in, and go to the casino’s site directly instead. Shuffle and Roobet both warned users about phishing after the 2025 Fast Track breach.
Is Duel the same as Duelbits?
No: Duelbits is run by Liquid Entertainment N.V. and launched in 2020, while Duel (duel.com) is a separate company, run by Immortal Snail LLC, that launched in 2025. The hacks on this page in February 2024 and September 2026 were at Duelbits, not Duel.
How We Track Crypto Casino Hacks
This tracker is compiled by VIP-Grinders from public sources, and every figure was checked against its source directly rather than taken from other lists. Where sources disagree, the page says so and shows both figures.
What Counts as an Incident
An incident is included when it meets one of the rules below. Allegations that do not meet them are left out, however widely they are shared.
- Thefts and exploits: confirmed by the operator, by law enforcement or by a named security firm.
- Thefts flagged on chain: included even before the operator comments, with a note that the operator has not confirmed.
- Data breaches: confirmed by the operator, by its supplier or by Have I Been Pwned.
- Left out: anonymous claims, screenshots and forum posts, and losses at exchanges or DeFi protocols with no gambling link.
How the Totals Are Calculated
All amounts are in US dollars at the time of each incident, as reported by the source. The lower total uses the lowest credible figure for each theft and the higher total uses the highest. Neither counts data breaches or the refunded Gamdom dice bug.
- Alphapo and CoinsPaid, July 2023: the FBI's combined $60 million, against $97.3 million if CoinsPaid's own figure and ZachXBT's Alphapo figure are added.
- CoinsPaid, January 2024: €4.08 million from its own accounts, converted at about $1.09 per euro, against $7.5 million from Cyvers.
- Duelbits, September 2026: about $6 million traced on chain, against $7 million from Duelbits.
- Gamdom, October 2026: just over $3 million from Gamdom, against $4.2 million traced by vxdb.
- Smaller differences: EOSBet in September 2018 and GMBL.COMPUTER, where sources give slightly different dollar values.
Sources We Use
Each entry rests on the sources below, starting with the operator’s own words wherever they exist.
| Source | Examples | Used For |
|---|---|---|
| Operator statements | Posts and emails from Stake, CoinsPaid, Gamdom, Duelbits, BC.Game, Shuffle, Roobet, 1win, Primedice and others | Amounts, causes, responses and whether player funds were affected |
| Law enforcement | The FBI’s statement of 6 September 2023 | Attribution of the Stake, CoinsPaid and Alphapo attacks |
| Security firms and investigators | CertiK, Cyvers, PeckShield, Halborn, Scam Sniffer, Seal 911, ZachXBT, vxdb | On chain amounts, timing, chains and laundering routes |
| Breach databases | Have I Been Pwned | Size and contents of the 1win breach |
| Hack databases | DeFiLlama, SlowMist Hacked | Checking that no gambling incident has been missed |
| News reporting | CoinDesk, Cointelegraph, The Block, iGaming Today and others | Details reported at the time, checked against at least one other source where possible |
Limitations
Readers should weigh these points when using the figures on this page.
- Not every incident is public: some operators never disclose a hack, and many small exploits of on chain gambling apps were never widely reported.
- Operator statements are reported, not verified: when a casino says user funds are safe, the page records that it said so.
- Dollar values depend on the snapshot: security firms value stolen tokens at slightly different moments, so their figures can differ for the same incident.
- Attribution is rare: only three attacks on this page have been attributed by law enforcement, all by the FBI.
Editorial Independence
VIP-Grinders has commercial relationships with some of the operators on this page. No operator reviewed this page before publication or paid to be included, left out or described in any particular way. Every incident is listed under the same rules, and if new facts change an entry, the update log below records it.
Update Log
New incidents are added as they are confirmed, and the totals are recalculated each time.
- 22 October 2026: tracker published with 18 thefts and exploits, four data breaches and one provably fair bug, and at least $132 million stolen.
This tracker is part of the VIP-Grinders research programme, alongside our monthly reports on crypto casinos, prediction markets and online poker traffic.
If you are a journalist or researcher using this data, or you know of an incident we have missed, contact the VIP-Grinders team and João Mourato will reply with sources and context.