Loading story…
Crypto casino Duelbits confirmed that an unauthorized incident drained approximately $7 million from its hot wallets, forcing the platform offline. Suspicious transfers affected wallets on Ethereum, BNB Chain, Tron, and Bitcoin; the stolen assets were reportedly consolidated primarily into Ether. Blockchain security firm Scam Sniffer assessed the activity as a possible private-key compromise.
Duelbits said customer funds remain safe and that it has identified the incident, though it has not disclosed the attack vector, custody design, or technical root cause. The company is investigating the breach while rebuilding deposit and withdrawal infrastructure and replenishing hot wallets before restoring services.
Track how attackers are adapting to this technology.
4 events from the most recent confirmed update back to the earliest known activity.
On X, Duelbits co-founder Joe said that customer funds remained safe and that the company had identified what occurred. He said an official statement would follow within 24 hours while the company rebuilt deposit and withdrawal infrastructure before restoring service.
Duelbits confirmed that an unauthorized incident had drained approximately $7 million from its hot wallets and took the platform offline. The company began investigating, replenishing affected hot wallets, and rebuilding deposit and withdrawal systems prior to restoring operations.
Investigators identified an additional unauthorized transfer of 8.1 BTC from a Duelbits Bitcoin hot wallet, bringing the reported total loss to about $7 million. Most stolen assets were reportedly converted into Ether and consolidated in an address holding roughly 2,234 ETH.
Scam Sniffer identified approximately $4.2 million in abnormal transfers from Duelbits hot wallets on Ethereum, BNB Chain, and Tron to newly created addresses. The activity was assessed as a suspected private-key compromise, though Duelbits did not confirm the attack vector.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cryptocurrency exchange **Bitget** confirmed that attackers stole approximately **$351.6 million** after gaining unauthorized access to part of its wallet infrastructure. The exchange detected unauthorized hot-wallet transfers at 18:31 UTC on September 24 and suspended withdrawals across its platform while it investigated with law enforcement and blockchain-security firms. Bitget CEO Gracy Chen said the incident was a direct breach of company systems or servers and said the exchange suspects North Korea-linked **Lazarus Group**, although it has not released technical evidence supporting the attribution. On-chain analysts initially observed roughly $165 million in ETH, stablecoins, and Tether Gold moving from Bitget-labeled wallets to a single externally owned address across Ethereum, Arbitrum, Optimism, and Base; the recipient later forwarded 19.67 million USDT0 received on Arbitrum. Bitget said deposits and trading remain available, customer balances are accurate, and its cold wallets and user private keys were not affected. It stated that its User Protection Fund, valued above $464 million, can cover the loss and pledged to publish a full incident report within 24 hours.
Sep 25, 2026
Bybit said attackers stole about **$1.5 billion in Ethereum** after taking control of one of the exchange’s wallets during a routine transfer from a cold wallet to a warm wallet, making the breach one of the largest digital thefts on record. The Dubai-based exchange said customer assets remained fully backed and pledged to reimburse affected users even if the cryptocurrency is not recovered, while the incident triggered more than **350,000 withdrawal requests** and briefly pushed Ethereum’s price down by nearly **4%**. Blockchain investigators at TRM Labs said the stolen funds came from one of Bybit’s offline cold wallets and assessed with **high confidence** that **North Korean hackers** were responsible, citing substantial overlaps between attacker-controlled addresses and wallets tied to earlier North Korean thefts. TRM tagged the compromised addresses under **`Bybit Exploiter Feb 2025`** and tracked the assets in real time, while Bybit offered a **10% bounty** to cybersecurity and crypto-analytics experts who can help trace and recover the stolen funds.
Aug 15, 2026
A wallet-drain campaign dubbed **Ill Bloom** exploited weak entropy in `CryptoJS.lib.WordArray.random()` to steal at least **$5.69 million** from cryptocurrency users, according to Coinspect. The flaw affected wallet applications that used vulnerable versions of CryptoJS to generate recovery phrases, allowing attackers to guess seed phrases, derive wallet addresses, and drain funds. Coinspect linked two theft waves between May 27 and July 13 to the issue and identified five affected apps: **RRWallet, Bexo Wallet, NanChat, Bitcoin Libre, and Milo**. The underlying problem traces to a long-standing weakness in CryptoJS random-number generation, broadly covered by advisory `GHSA-rg76-677x-56q9` for versions earlier than `4.0.0`, though exploitation depended on whether developers used the function for security-sensitive seed generation. Coinspect warned that simply updating an affected wallet does not secure wallets already created with weak recovery phrases; users must generate a new secure seed phrase and move funds, and additional vulnerable wallet apps may still exist beyond the five publicly named.
Aug 6, 2026