A metal chain stretched across the frame against a pale sea and sky

Analysis · Security and scams

Duelbits hack 2026: what the blockchain shows about the missing $7 million

Published 2026-09-28By the CryptoGuardz Register Desk5 min read7 sources

Photo: Karine Avetisyan / Unsplash

In short, from the documents

What does the blockchain show about the Duelbits hack?

The Ethereum address that collected most of the Duelbits hot-wallet theft received about 2,334 ETH on 24 and 25 September 2026 and held 973.5 ETH on 28 September. The operator's promise that user funds are safe was made on X, not in a document a player can enforce.

Piece published 2026-09-28Reviewed by CryptoGuardz Register Desk, editorial desk

The Ethereum address that collected most of the Duelbits hack received 2,334 ETH on 24 and 25 September 2026, and by the afternoon of 28 September it held 973.5 ETH. The rest, about 1,360 ETH net, had moved to two other addresses. Duelbits put the total loss at about $7 million across four chains and said on X that user funds are safe. That promise sits in a post, not in any document a player can hold the operator to.

Duelbits is not on the register. The hack is here because it shows what "your balance" means on a custodial crypto casino when the hot wallet empties.

What happened in the Duelbits hack?

On 24 September 2026 on-chain monitors ScamSniffer and PeckShield flagged outflows from Duelbits hot wallets. CoinDesk reported losses on Ethereum, BNB Chain, Tron and Bitcoin, including 8.1 BTC, and a suspected private key compromise. Duelbits posted that it was "investigating a security incident" and took the site offline. A co-founder, posting as @DuelbitsJoe, wrote:

Until we have clarity, Duelbits stays offline. User funds are safe.

Duelbits co-founder on X, 24 September 2026, as reported by Bitcoin.com News

The attack vector is the operator's suspicion and CoinDesk's reporting. No post-mortem had been published by 28 September: not disclosed.

Where did the Duelbits hack money go?

To address 0x8db9d7f0a03d212c566ca80c66e294cecc20c306 first, the consolidation address CoinDesk identified. Its full history was read from the Blockscout explorer on 28 September 2026.

Coloured push pins stuck into a paper map, shallow focus — Illustration: pins on a map. The section follows the hacked funds address by address on public block explorers. Photo: T.H. Chia / Unsplash

Date (UTC)	Movement	ETH
24 Sep, 12:37 to 13:08	In, eight transfers from three addresses	2,234.7
25 Sep, 11:07	In	99.0
26 Sep, 08:39 to 09:19	Out to one address	662.0
26 to 27 Sep	Back in from that same address	552.0
28 Sep, 08:01 to 08:44	Out to a second address, 1.9 back	1,250.1 net
28 Sep, 15:16	Balance left	973.5

Two habits show in the record. Each large transfer is preceded by a 1 ETH test, a pattern consistent with someone checking a route before sending size. And from 24 September onward the address received 23 transfers worth 0.000000001 ETH or less, most from addresses that share their first and last characters with a real counterparty. That is the address-poisoning pattern, in which lookalike addresses are planted in a wallet's history in the hope of a copy-paste mistake. Someone is trying to rob the robber.

The 2,234.7 ETH on 24 September matches CoinDesk's figure of about 2,234 ETH consolidated. The Tron, BNB Chain and Bitcoin legs were not traced here: not measured.

Are player balances safe after a casino hack?

That depends on a promise, not a contract. A crypto casino balance is a number in the operator's database. The coins backing it sit in hot and cold wallets the operator controls. When a hot wallet is drained, player balances do not change on screen; what changes is whether the operator can and will honour them.

A closed blue metal door with a heavy lock — Illustration: a locked door. Whether balances are honoured after a hack rests on the operator's promise rather than a contract, as the section explains. Photo: Chelaxy Designs / Unsplash

Duelbits says it will. FairGambling reported on 27 September that the site reopened with about $8 million restocked into its wallets and a "Duelbits 2.0" relaunch. Duelbits' site sits behind a browser challenge that was not bypassed for this piece, so the reopening is not verified. If it holds, the operator absorbed the loss.

The terms are the other half. Duelbits' own terms were not read for this piece: not verified. Across the fourteen operators the register does read, the instant withdrawal piece shows six commit to no withdrawal time at all, and that silence is the clause that governs a site coming back online after an incident.

Has Duelbits been hacked before?

Yes, according to FairGambling, which reports a drain of about $4.6 million from Duelbits wallets on Ethereum and BNB Chain in February 2024. That earlier incident was not traced for this piece: not verified.

How does it compare with the Stake hack?

Incident	Loss	Attribution	Source
Stake, Sep 2023	$41 million	Lazarus Group, per the FBI	FBI press release
Duelbits, Sep 2026	about $7 million	Not disclosed	Operator on X, CoinDesk

Stake kept operating after its own incident, and its register entry records that the FBI attribution is not evidence about Stake's conduct toward players. The same caution applies to Duelbits. A hack is evidence about key management. It says nothing on its own about whether a casino pays.

What this does not show

The identity of the attacker, the full four-chain total and the state of Duelbits' reserves are all unknown to this piece. The $7 million figure is the operator's. The on-chain numbers above are Blockscout's and can be rechecked by anyone at the address in the sources.

Quick answers

How much was stolen in the Duelbits hack?

Duelbits put it at about $7 million across four chains. On Ethereum, 2,334 ETH reached the consolidation address on 24 and 25 September 2026.

Where is the Duelbits hack money now?

On 28 September 2026 the consolidation address held 973.5 ETH; about 1,360 ETH net had moved to two other addresses. Anyone can check it on Blockscout.

Did Duelbits players lose their balances?

Duelbits said on X that user funds are safe, and FairGambling reported a reopening on 27 September. Neither is a contractual guarantee, and the reopening is not verified. See instant withdrawal terms for what contracts promise.

Is Duelbits on the CryptoGuardz register?

No. The register covers fourteen operators, and Duelbits is not one of them, so it has no licence or terms record here.

Where can I get help with gambling?

Gambling Therapy offers free international support at gamblingtherapy.org, and more options are on the responsible gambling page.

More analysis

2026-09-28Drake and Adin Ross Stake lawsuit: what the complaint alleged and why it was pausedA Virginia class action accusing Stake.us, Drake and Adin Ross of running an illegal casino and moving money through tips was stayed on 30 July 2026. Stake.us's terms bind players to individual arbitration unless they opted out within 30 days.2026-09-28What fourteen crypto casinos' terms say happens to your balance when verification fails or a VPN is detectedSix of the twelve operators whose terms could be read reserve the deposit as well as the winnings when a restricted-territory or VPN breach is found. One writes that the deposit is returned, one says it may be, and two write balance forfeiture into the verification clause itself.2026-09-28Sending crypto from an exchange straight to a casino: what the exchange can doOf twelve exchanges on the register, OKX, Bitget and MEXC prohibit gambling transfers outright, OKX and Gate attach a freeze or confiscation power to their gambling clause, Coinbase can claw back a transfer it links to prohibited use, and Binance, Crypto.com and HTX say nothing. Routing through a self-custody wallet moves the balance out of reach of those clauses; it does not change what they say.2026-09-28Gambling Commission affordability checks: what the rules say, and what crypto casinos publish insteadIn Great Britain the financial vulnerability check triggers at 150 GBP of net deposits in a rolling 30 days and reads public insolvency records. Of the 14 offshore crypto operators on the register, 11 publish no deposit or affordability threshold of any kind.2026-09-28Curacao Gaming Authority hack: what the regulator confirmed and what it means for licence checksThe Curacao Gaming Authority confirmed on 17 and 22 September 2026 that its licensing portal was accessed from December 2025 to September 2026 under a false identity. It has not confirmed what was taken. Eight of the fourteen register operators hold its licences.2026-09-28Gambling KYC under five regulators, and which of them licenses the fourteen crypto casinos on the registerThree of five regulators publish a hard rule on when gambling KYC must happen: before play in Great Britain, within 30 days of 2,000 euros in deposits in Malta, before any payout in Kahnawake. Anjouan publishes no timing and Curacao's rule pages could not be retrieved, and those two license all fourteen operators on the register.

Sources

About this piece

Compiled by the CryptoGuardz register team from the sources listed above. Research and drafting are AI-assisted and reviewed by a named editor before publication. Nothing here is a recommendation to gamble. If a figure or a reading is wrong, tell us and the correction is logged in public.