Duelbits has taken its website offline after a major security incident resulted in millions of dollars worth of cryptocurrency leaving wallets controlled by the crypto casino. The platform said it was investigating the incident and had temporarily shut down the site as a precaution while working to determine what happened and when services could safely resume. Initial blockchain monitoring from PeckShield identified roughly $4.3 million in suspicious outflows involving Ethereum and BNB Chain, while later reporting placed the broader loss at around $7 million across multiple networks.
Duelbits Hot Wallets Drained Across Multiple Networks
The first on-chain alert identified a wide range of assets moving from addresses associated with Duelbits. The transactions included 836 ETH worth about $2.23 million, 1.146 million USDT, 209 BNB, approximately 96,805 USDC, 12.398 billion SHIB and 31,515 DAI. PeckShield subsequently reported that most of those assets had been converted into approximately 1,587.87 ETH and 31,500 DAI, indicating that the attacker was rapidly consolidating the assets rather than leaving the original tokens untouched.
Ethereum transaction data provides a clearer picture of how quickly some of the funds moved. An address identified as receiving assets from a Duelbits wallet accumulated DAI, SHIB, USDC and USDT within minutes before routing portions of those holdings through cross-chain infrastructure. The movements included transfers associated with deBridge and Relay, allowing assets originally held on Ethereum and other networks to be converted and consolidated into fewer assets and addresses.
Security-monitoring data later indicated that the incident was not limited to Ethereum and BNB Chain. SlowMist recorded suspected losses involving Duelbits’ multi-chain hot wallets and described the incident as a suspected private-key compromise, with funds associated with Ethereum, BNB Chain, Tron and Bitcoin. That assessment remains an external security classification rather than a final explanation from Duelbits, meaning the precise method used to obtain wallet access has not yet been conclusively established.
The scale of the incident also explains why Duelbits moved quickly to take its website offline. Hot wallets are designed to keep assets accessible for operational purposes, including deposits and withdrawals, but their connection to online systems can create additional security exposure. When unauthorized transactions are detected, taking the platform offline can limit further movement while investigators review wallet permissions, private-key access, infrastructure and transaction history.
Stolen Crypto Consolidated Into Ethereum
The most notable development following the initial withdrawals was the conversion of multiple stolen assets into ETH. Later blockchain tracking showed that roughly 2,234 ETH, worth around $6 million at the time of reporting, had been consolidated into a single Ethereum address. The address reportedly remained largely untouched, creating a visible on-chain holding that investigators and security firms can continue to monitor.
That consolidation does not mean the funds have been recovered. Ethereum transactions are publicly visible, but identifying the individual or group controlling an address is a separate challenge. Moving funds into one wallet can make the balance easier to track, while subsequent transfers through exchanges, bridges, mixers or other services could complicate efforts to identify the final destination.
There is also an important difference between the initial $4.3 million estimate and the later $7 million figure. PeckShield’s first alert covered suspicious outflows it had identified on Ethereum and BNB Chain, while later investigators identified additional movements and losses involving other networks. The changing estimate reflects the fact that blockchain incidents are often reconstructed in stages as security researchers connect wallet addresses and cross-chain transactions.
Duelbits has previously experienced a significant security incident. Reporting on the latest attack notes that the platform lost approximately $4.6 million in a February 2024 incident, with the stolen assets also moved through cross-chain infrastructure and converted into ETH. The recurrence makes the current investigation particularly relevant for users and operators because it raises questions about wallet architecture, key management and how hot-wallet exposure is controlled.
For users, one of the key unanswered questions is whether customer balances were directly affected. PeckShield’s initial alert did not establish whether the suspicious transfers represented customer funds, operating liquidity or other assets controlled by the platform. Later reporting quoted Duelbits’ founder as saying user funds were safe, but the platform’s investigation remains important for establishing the full scope of the incident and explaining how the affected wallets were accessed.
The incident also highlights a broader security issue for crypto platforms that maintain large online balances. Once a private key or wallet authorization mechanism is compromised, blockchain transactions generally cannot simply be reversed by the platform itself. The ability to trace funds provides investigators with valuable evidence, but recovery depends on whether the assets eventually reach identifiable services or remain under the attacker’s control.
For now, the Ethereum address holding the consolidated ETH remains the most visible part of the investigation. Blockchain researchers can monitor whether the approximately 2,234 ETH moves, while additional addresses and cross-chain transactions can potentially reveal where other portions of the stolen assets have gone. Duelbits has said its website will remain offline while the investigation continues and security measures are reviewed before operations resume.
The Duelbits incident therefore remains an active security investigation rather than a completed recovery case. What began with a roughly $4.3 million alert on Ethereum and BNB Chain developed into a broader incident estimated at around $7 million after additional wallet activity was identified. Until Duelbits publishes a fuller post-mortem, the exact attack vector, final loss and recovery prospects remain subject to further investigation and on-chain analysis.
About The Author
