Duelbits - Rekt

Duelbits replaced its Ethereum hot wallet after a $4.6 million theft in 2024.

On September 24, 2026, assets traced from Duelbits-linked hot wallets across five chains were worth an estimated $6.07 million.

Among the affected wallets was the Ethereum hot wallet Duelbits had publicly named after the 2024 breach.

Duelbits co-founder Joe put the loss at roughly $7 million.

Investigators traced outflows on Ethereum, BNB Chain and Tron and identified receiving addresses on Bitcoin and Solana.

The transfers documented across those five chains amount to approximately $6.1 million at the prices used in this analysis; they do not independently reconcile the full amount Joe reported.

Scam Sniffer described the outflows as a suspected private-key compromise.

Joe promised an explanation within 24 hours and projected a quick reopening.

Joe said the site would remain offline longer while Duelbits secured its systems and replenished its wallets. On September 27, Duelbits announced it had reopened, with deposits and withdrawals enabled.

In an April 5, 2026 blog post, Duelbits wrote under “Track record”: “Duelbits has operated since 2020. No security breaches, hacks, or unauthorised fund access incidents have been reported in that time.”

The claim contradicted Duelbits’ own February 2024 acknowledgment that its Ethereum hot wallet had suffered a “security breach” resulting in an “unauthorized withdrawal.”

That contradiction makes the earlier breach more than background: it raises questions about what Duelbits changed afterward.

What did Duelbits change after the first theft, and how did an attacker gain the ability to move funds from its replacement wallet?

At 08:58 UTC on September 24, 476,058 USDT moved from a Tron wallet that Scam Sniffer identified as belonging to Duelbits.

At 08:59 UTC, 552,762 USDT left a Duelbits hot wallet on BNB Chain. Duelbits had announced the same wallet address as its new Ethereum hot wallet after the 2024 breach

Transfers followed from that wallet on Ethereum: 593,430 USDT, 96,805 USDC, 31,515 DAI and about 12.4 billion SHIB. The wallet then sent 836 ETH at 09:02:47 UTC.

The three identified USDT transfers across Tron, BNB Chain and Ethereum total approximately $1.62 million USDT, the amount Scam Sniffer later cited.

At 09:42 UTC, 8.09987887 BTC reached an address identified in the investigation by Specter.

At 9:52 UTC, Scam Sniffer reported roughly $4.2 million in outflows from Duelbits hot wallets on Ethereum, BNB Chain and Tron, calling it a suspected private-key compromise.

The estimates that followed covered different points in the investigation.

At 10:15, PeckShield estimated approximately $4.3 million on Ethereum and BNB Chain and said the assets it tracked had been swapped into 1,587.87 ETH and 31,500 DAI.

At 10:28, Specter put the total at about $4.9 million after including more than $600,000 in Bitcoin; Scam Sniffer reached a similar estimate in an update that counted about 8.1 BTC.

At 11:42, CertiK flagged roughly $6 million in suspicious outflows and pointed back to the approximately $4.6 million incident it had reported in February 2024.

Also at 11:42, Duelbits said it was investigating "a security incident" and had taken the site offline as a precaution.

Its post gave no loss figure or explanation of how the funds had been accessed, two hours and 44 minutes after the first identified transfer.

Co-founder Joe said Duelbits would return "asap" at 12:43 UTC.

At 13:38, he confirmed "a ~$7M hack", said the team was "still investigating exactly what happened and how," and asserted that user funds were safe.

His stated next steps included launching Duelbits 2.0, an upgrade he had promoted two days earlier.

Those figures were successive estimates, not a reconciled tally.

Duelbits did not provide a chain-by-chain accounting or publicly explain how the attacker gained access in those September 24 statements.

If Duelbits had not explained the access route, what could the drained address itself reveal?

Return Address

Scam Sniffer described the September 2026 outflows as a "suspected private key compromise".

SlowMist lists "Private Key Leakage" as the incident's attack method.

Those assessments do not, on their own, establish that a private key was extracted.

The transfers document the movement of funds, not how the attacker gained the ability to move them.

The identified Tron, BNB Chain and Ethereum transfers show funds moving out across multiple networks. Their timing does not reveal where or how access began.

Later on September 24, Joe said Duelbits had "identified what happened" and promised an official statement within 24 hours. He said the company was rebuilding its deposit and withdrawal servers "to make sure everything is 100% secure." "A few people ruined it for everyone else," he added, without identifying them or explaining their role.

The missing explanation matters because this was not the first reported theft. In February 2024, CertiK estimated that roughly $4.6 million had been taken from Duelbits and described a private-key compromise as possible.

Duelbits subsequently acknowledged that its ETH hot wallet had suffered a "security breach" resulting in an "unauthorized withdrawal" and publicly named a new ETH hot wallet.

That replacement address is the one identified in the September 2026 Ethereum and BNB Chain transfers.

The address match does not establish that the same attacker, credentials or access route were involved. It does make what Duelbits changed after the first breach a central unanswered question.

It does make what Duelbits changed after the first breach a central unanswered question. Duelbits claimed in April 2026 that no breach had been reported since it began operating in 2020, despite acknowledging a breach of its Ethereum hot wallet in February 2024.

That contradiction makes an account of what changed, and what failed, more important.

The access route remains unverified. The subsequent movement of the funds is more visible.

Duelbits hasn't said how the funds got out, so what does the chain show about where they went?

Cashing Out

The identified Ethereum and BNB Chain transfers went to one recipient.

CertiK also flagged receiving addresses on Tron, Bitcoin and Solana, but the addresses alone did not establish how much each received.

The transaction listings examined for this piece put the Ethereum and BNB Chain assets in one wallet, the Tron and Solana assets in separate wallets, and an approximately 8.1 BTC output at the flagged Bitcoin address.

Duelbits Hot Wallet (sender, Ethereum / BNB Chain):
0x014435B1E39945CF4f5F0c3cbb5833195A95CC9B

First Recipient on Ethereum:
0xA77e24Fe29d16E051e487ef4Ea7b056cb05aef76

Recipient on BNB:
0xA77e24Fe29d16E051e487ef4Ea7b056cb05aef76

The Ethereum recipient received 836 ETH, 593,430.32 USDT, 96,804.68 USDC, 31,515 DAI and about 12.4 billion SHIB.

On the BNB Chain, that same recipient received 209 BNB and 552,761.72866981 Binance-Peg USDT.

PeckShield listed the same Ethereum and BNB Chain assets in rounded amounts.

Ethereum Transfer (836 ETH):
0xcdc0b6dfacbefe4aef640be1538c9081bbf401ca9ad9784e1b0cfc044523182d

Ethereum Transfer (593,430.32 USDT):
0x4f2bc2a8bc5040788c71e712546deec6d0f61529518b8114b0334ffd3e9bb739

Ethereum Transfer (96,804.68 USDC):
0xf9cd780608100fad136e4cb9a334c4faa6cd4fd4f0007bd4b6334ba71128eedf

Ethereum Transfer (31,515 DAI):
0x9ded7a9c5a4d1f4f1aa06d972bb423ce5f186d436d229727a185b4279d4fd746

Ethereum Transfer (about 12.4 billion SHIB; explorer display rounded):
0x0ef345e1d19cfef9e46517b5d7d9dba2c25893a90f548a92dc964cdab1caf3f7

BNB Chain Transfer (552,761.72866981 BUSD-T):
0x0a79ed0be9a608f623bb1e12d2e8e811237d0c87b396373f7d6f1aa1f78bb885

BNB Chain Transfer (209 BNB):
0x56477897e9510c50fe561bf5eaac33a32762af43e42b546011cca6ae4f3b1cd1

The Tron recipient received 476,058.087528 USDT and 192,470 TRX from the Duelbits-attributed Tron wallet.

On Solana, the wallet identified in the investigation received 5,325.764 SOL, 397,880.061828 USDC and 44,850 TRUMP across transfers from a Solscan-labeled Duelbits hot wallet.

The largest individual receipts were 5,294 SOL, 396,514 USDC and 44,850 TRUMP. The totals include smaller transfers as well.

Duelbits Hot Wallet on Tron:
THqFmhAPcdHECH3wmrpZv4MWAB2v9TY1oN

Tron Recipient (identified by CertiK): TAvraZZFCZbDSZoyqWWRRsBkFgZqKaCGbK

Tron Transfer (476,058.087528 USDT):
2793e4b8ab5f8abc3bc461ba45b19d2ea247831be8afb6d1e8068e81ad2a9e2dTron Transfer (192,470 TRX):
e6d138b8f44c0fab7459f3616f71f933c885d2dabd83ea30fdaa7c184421146a

Duelbits Hot Wallet on Solana:
FoxqdkGRDZstVFA3wAyLnhua5ZB7jpoE36L3kcUAMqf4

Solana Recipient (identified by CertiK):
A3EBrhMBEGzcPgmbwywSPhW39G6PFGrorU8ib99T6yKw

Solana Transfer (5,294 SOL):
5nUNaY8UA3AFe4BzQLnP5Ly6iNqxENtVCsc1ThPVcayyc27Xzx7qnEFy19VnaeT6nubkAJd6QzHq1CwBkNyPgna3

Solana Transfer (396,514 USDC):
2r2noXY8xgPPXaPFE7toBrkijRgBBJoVdcySz7qXXhjod9ESuh6h7KrwZFevUq8sUXzaR4wvrTXaaEF3zWSQ8fWx

Solana Transfer (44,850 TRUMP):
5n47G7vB5oKcLpXthW3oh6uz4Kh3SnEqufzJq5sqDoFjD1BW3gY7uqpsbbmdj9eMxLCpZyHzC8TPb2AbzrRsqkjN

The Bitcoin transaction combined 121 inputs. Arkham labels all 121 as Duelbits-associated, and Scam Sniffer described the transaction as an approximately 8.1 BTC outflow from a Duelbits Bitcoin hot wallet.

Of the transaction’s two outputs, 8.09987887 BTC went to the recipient flagged by CertiK; the other, 0.01132036 BTC, went to an address Arkham also labels Duelbits.

Bitcoin Recipient (identified by CertiK):
bc1qhtu84kz3y94lvgl2t05zk84tqh57grvd82zvcl

Bitcoin Transfer (8.09987887 BTC):
159e274755432366d2589ef7ed809c440b262ed2e23277ca8d4a2bcd506bf221

Other Bitcoin Output (0.01132036 BTC; Arkham-labeled Duelbits address):
bc1qe8w33uzvd5jyxmnfq37cx2nts67p29myudxcud

The identified receipts have an estimated value of about $5.39 million excluding Bitcoin. Including the 8.09987887 BTC sent to the recipient flagged by CertiK raises the estimate to about $6.07 million.

Arkham labels all 121 inputs to that Bitcoin transaction as Duelbits-associated.

Those figures are estimates of the assets traced here, not an independently reproduced version of CertiK's exact loss figure or a reconciliation of Joe's roughly $7 million claim.

Most of the funds did not remain in their original assets. PeckShield said the Ethereum and BNB Chain assets it tracked had been swapped into 1,587.87 ETH and 31,500 DAI.

The DAI moved later; The Defiant reported that an intermediary converted 31,515 DAI into about 11.78 ETH after fees.

Cross-chain movement added another potential source of double-counting. Seven BNB Chain-to-Ethereum deBridge orders marked “Fulfilled And Unlocked” listed destination amounts totaling 263.469264 ETH.

Etherscan’s internal-transactions list shows seven corresponding ETH credits from deBridge’s destination contract to the first Ethereum recipient. The total comes from deBridge’s six-decimal order displays; Etherscan’s address-level list rounds the credits.

BNB Chain deBridge Route 1 (source transaction):
0x44888e81ce15e6506b8453700fb0c1458402aee62d3422338db393bb06d2f830

Ethereum deBridge Route 1 (56.56 ETH credited):
0xd09102d4d040bd7429be6f4aba72e075c884b35b275fa39e524236717ce6325f

BNB Chain deBridge Route 2 (source transaction):
0x9e4d9a5f4af709b28e7bfd0de80ba5fdf93bfbaa6c2be84dfdb01f6acffae521

Ethereum deBridge Route 2 (approximately 19.76 ETH credited):
0x4b3398ce505afd8e5788317b7590764b3f7ce05c53736affe77af684bc73ade5

BNB Chain deBridge Route 3 (source transaction):
0xfa12bfc97faa90d025a141d1b7f0184b57e1cf0ad2dde275df1acb6cc2a62b5e

Ethereum deBridge Route 3 (approximately 37.43 ETH credited):
0x2a4c0ee05d2ab1f031d07d9786a9f417f395ab5e0e4855d89abeabfb7261fa5b

BNB Chain deBridge Route 4 (source transaction):
0xb3f870c7d217283a3e7f742b7f82373bf33057822a8f944d483eabd663f1ee3f

Ethereum deBridge Route 4 (approximately 37.42 ETH credited):
0xf8708726bfe26da8ffffd7c0ab22ef51425b491020d224a4ffa5521dd5690eeb

BNB Chain deBridge Route 5 (source transaction):
0x0a8f247b3606553b7cfc12206e19b0c0983ac586a73e5d06ef2d63a4b97e62af

Ethereum deBridge Route 5 (approximately 37.45 ETH credited):
0x3a74f502ab30ae8b63bdca40acf567ea02b27fbab1d6de5dbe17c10b57a6226f

BNB Chain deBridge Route 6 (source transaction):
0x23fce58e28878ec95e16ca0c38043f248e6a0cb2b1410345ad7c6d2add162843

Ethereum deBridge Route 6 (approximately 37.45 ETH credited):
0x9c0b4a5164c08e040df8062b546dc6c3b191c3663b1ee7ffce24cbf6766a070b

BNB Chain deBridge Route 7 (source transaction):
0x2f2b0f45609bcd5ffd823fbf1887142a62aa209f03a1db200e44af60d06c3b99

Ethereum deBridge Route 7 (approximately 37.40 ETH credited):
0xec624f7e38a59e9813d53686201057f581197c943495eb83b547635545734420

The Tron recipient later sent its USDT into a SunSwap transaction that returned 1,396,632.284029 TRX.

Tron SunSwap Transaction (1,396,632.284029 TRX returned to the Tron recipient):
8f948ee9c3a6e04e5ebf72115b8724ac63eb1648b4dec1b16b926ec344fd75cc

On Solana, the recipient later swapped portions of its USDC and TRUMP holdings into wrapped SOL (WSOL). Solscan’s activity list shows six swap entries across five transaction signatures; two TRUMP swap entries share one signature. These swap outputs are later forms of assets already counted, not additional initial receipts.

Solana Swap (100,000 USDC → 877.771263845 WSOL):
4dX4pK1QTUK5SdtEK2S3k3FwrMemDVtDNCFJ5TZbDfWdejjs5ZMHwWqHdKNDWMEt9N94hx5iT9zbGNrCEJKsK6V8

Solana Swap (24,850 TRUMP → 429.25583428 WSOL):
25wPGtTNG4EAHwUXWLtL8EU2D5zxzzAAAYFBuS1EYR85gW25oTTyRqZKaTCje33ZCTBXmZk9bMuQ1SUEr1LFSaUQ

Solana Swap (19,970 TRUMP → 345.232520312 WSOL; same transaction also lists 30 TRUMP → 59.213033 USDC):
f2Z8pTrbEushH3hVfm4VCqs5cPRkSV7koSNqVn6tFvZZVBvMbqr89fiPoXmCn7KYDmdmqGiRjD8aGDB84Zo8T1j

Solana Swap (1,342.08714 USDC → 11.820142938 WSOL):
3M32crzuMaWNfc4GHrv3zMhJPhNoTZfkm5w7va1Japd7HKuKTRjHsfGj2exdkpBSgeUTM8YmSWvD5DPEJjneFpHo

Solana Swap (23.974688 USDC → 0.211772304 WSOL):
2jvfyS2YtqN8hjD9C45wyY39rrXr1C8kbXYMqnNJEAEsDDqER1JDn7UvkScZMw9W8kE9EYGfo13vdBVnkaxUizpa

Much of the resulting ETH was gathered in a consolidation wallet. The transaction records supplied for this review show the first Ethereum recipient sending 1,577.88 ETH to an intermediary that subsequently forwarded large tranches to the consolidation address.

First Ethereum Recipient → Intermediary (1,577.88 ETH):
0x4fa5a3bcef68c24d1ea0c4b0eb39d0e46575e075539bec9a66fa0852ff2b0496

CoinDesk reported about 2,234 ETH there on September 24. Its description of the funds as unmoved applied when it was published, not indefinitely: The wallet later sent ETH to other addresses.

Ethereum Intermediary:
0x181A638038A4bD75c207d080DE83e217f8e8a1d7

First Recipient → Ethereum Intermediary (1,577.88 ETH):
0x4fa5a3bcef68c24d1ea0c4b0eb39d0e46575e075539bec9a66fa0852ff2b0496

Consolidation Address:
0x8dB9D7f0a03d212c566Ca80c66e294CeCC20C306

A ChainBounty community investigation reported 20 Tornado Cash deposits totaling 1,370 ETH by wallets associated with the consolidation address.

Across Ethereum, BNB Chain, Tron, Solana and Bitcoin, the identified receipts had an estimated value of about $6.07 million.

Duelbits announced they had reopened on September 26th. But reopening the platform did not, by itself, settle what had happened to the funds.

What, exactly, did that relaunch establish?

Topped Up

Duelbits' recovery plan had four steps, as Joe listed them on day one: Finish the investigation, re-top hot wallets, bring the site back, launch Duelbits 2.0.

Duelbits said it had re-topped the hot wallets, and announced the site was back, later than promised.

No findings from the investigation have been published so far, and Duelbits was still describing 2.0 as forthcoming when it reopened.

At 22:38 UTC on September 24, Joe said the site should be back within about 15 hours. He told followers to "ignore the FUD" and promised Duelbits would be "back stronger than ever."

The next morning, the official Duelbits account said it was still offline for "final security checks" and promised a more detailed update "very soon."

By that afternoon, Joe was apologizing for more downtime. The team was topping up hot and cold wallets, and players would be able to withdraw immediately once the site returned, he said. Also mentioning Duelbits 2.0 was penciled in for early October.

The next evening on September 25, Joe identified three wallets he said would be used to restock the hot wallets, describing the funding as roughly $8 million.

ETH + stables (2,000 ETH):
0xB62C7836500A4E13dAeF19Da7a25D04c8a5F7eC0

500 ETH was moved to another Duelbits labeled Wallet:
0x1c525A31E90AF0Bb379c708aB6bE84eF9248ec94

SOL + stables (5,703 SOL):
ANh1jaSqmhSzCX2YBsvNBecBNRBqcJuztgzv1gzMXiNy

5702 SOL was moved to another Duelbits labeled Wallet:
FkHGJmNX943Sz9ww7J7BndT2j3AG3fKA4cSZd3wTJo8g

BNB + stables (~400K B-USD and 128.5 BNB):
0x304715b278a2f9B08c1944B1E7e2750ba5Bf0b70

All of the BNB funds were moved to another Duelbits labeled Wallet:
0x1c525A31E90AF0Bb379c708aB6bE84eF9248ec94

Publishing funding wallets is a step toward transparency. It is not proof of reserves. Those addresses identify wallets Duelbits said would fund operations; they do not show what the platform owes players.

At 05:04 UTC on September 27, Duelbits was back. Deposits and withdrawals were live, the team had taken "the extra time to rebuild and test everything properly," and, Duelbits said, around $8 million sat across hot and cold wallets, "ready to pay out."

Players were told: “Deposit addresses have changed. Always get your new one from your account.”

The official statement Joe had promised within 24 hours on September 24 still had not materialized when the site reopened; in a follow-up statement on September 27, where Joe stated that he was “working on an official explanation,” then argued that attention arrives only when “stuff hits the fan.”

As of October 2nd, no public root-cause report or chain-by-chain accounting has been released to the public.

What players do have are assurances. Joe and the official account both said user funds were safe.

In an April 2026 blog post, Duelbits claimed player crypto sits in "offline, air-gapped wallets" and that the casino "maintains reserves sufficient to cover all player balances."

The same page said no breaches had been reported since 2020.

Except Duelbits had reported a breach in February 2024, Duelbits publicly announced that it was replacing its Ethereum hot wallet after attackers stole roughly $4.6 million.

The April 2026 post therefore presented a record that conflicted with Duelbits’ own public disclosures.

As somebody that spends the majority of their time not trusting, but rather verifying, this makes my skin crawl.

If reopening shows Duelbits is back in business, what shows it learned anything from the last time?

Two thefts, one replacement address, and still no public account of what changed in between.

Duelbits did the visible work quickly.

They took the site offline, posted wallets intended to replenish its hot wallets, and said it had reopened with about $8 million across hot and cold storage.

What it has not shown is how the attacker gained the ability to move funds from the replacement address.

Security researchers suspect a private-key compromise, but Duelbits has not disclosed the cause. The explanation Joe promised within 24 hours, still has yet to manifest as of October 2nd.

That is the record players are left to reconcile: A company publicly responding to breaches while its own marketing page says they never happened.

The gap is not merely what Duelbits has yet to explain, but what its own public record still asks players to overlook.

If a casino makes every roll verifiable, why is its security history the one thing players are expected to take on faith?

REKT представляет собой общественную площадку для анонимных авторов. Мы не несём ответственность за выражаемые точки зрения или контент на этом веб-сайте.

Пожертвование (ETH / ERC20): 0x3C5c2F4bCeC51a36494682f91Dbc6cA7c63B514C

Дисклеймер:

REKT не несет никакой ответственности за любое содержание, размещенное на нашем Веб-сайте или имеющее какое-либо отношение к оказываемым нами Услугам, независимо от того, было ли оно опубликовано или создано Анонимным Автором нашего Веб-сайта или REKT. Не смотря на то, что мы устанавливаем правила поведения и нормы публикаций для Анонимных Авторов, мы не контролируем и не несем ответственность за содержание публикаций Анонимных Авторов, а также за то, чем делятся и что передают Авторы с помощью нашего Сайта и наших Сервисов, и не несем ответственность за любое оскорбительное, неуместное, непристойное, незаконное или спорное содержание, с которым вы можете столкнуться на нашем Веб-сайте и на наших Сервисах. REKT не несет ответственность за поведение, будь то онлайн или офлайн, любого пользователя нашего Веб-сайта или наших Сервисов.