What happened
On September 24, 2026, crypto casino and sportsbook platform Duelbits suffered a multi-chain hot wallet compromise resulting in estimated total losses of $4.9M to $7.0M across Ethereum, BNB Chain, Tron, Bitcoin, and Solana. The platform took its services offline to investigate and refill operational hot wallets while user cold storage remained unaffected.
The attack was executed via a private key compromise targeting Duelbits' operational hot wallets across five blockchains. On EVM chains, the attacker extracted 836 ETH, 1.146M USDT, 209 BNB, 96.8K USDC, 31.5K DAI, and 12.4B SHIB, alongside 8.1 BTC on Bitcoin and 192K TRX on Tron. The attacker routed the stolen multi-chain assets through swap protocols and cross-chain bridges, converting the proceeds into Ether and consolidating approximately 2,234.6 ETH (~$6.0M) into a single destination Ethereum address.
Duelbits confirmed the hot wallet breach and suspended operations pending system remediation and hot wallet refilling.
Attacker EVM Address 1: 0xA77e24Fe…5aef76
Attacker EVM Address 2: 0x6761c9b1…B3EF1c
Attacker Bitcoin Address: bc1qhtu84kz3y94lvgl2t05zk84tqh57grvd82zvcl
Attacker Tron Address: TAvraZZFCZbDSZoyqWWRRsBkFgZqKaCGbK
Attacker Solana Address: A3EBrhMBEGzcPgmbwywSPhW39G6PFGrorU8ib99T6yKw
Protocol details
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
