On September 24, 2026, crypto casino Duelbits took its site offline after attackers drained its hot wallets on Ethereum, BNB Chain, Tron and Bitcoin. Cofounder Joe confirmed a hack of about $7 million, while blockchain security firms tracked between $4.2 million and $6 million depending on which chains they counted. It is the second time Duelbits has lost millions from its hot wallets, after a $4.6 million drain in February 2024.

This time the drained Ethereum wallet is the same address Duelbits announced as its new hot wallet after that 2024 hack. The Tanzanite data behind our Crypto Casino Market Report adds a second marker: across the wallets it tracks for Duelbits, the balance fell about 58% on September 24 to $607K, its lowest level in four weeks.

Duelbits says user funds are safe, the same assurance it gave after the 2024 breach, but it has published no proof of reserves and no root cause. As of September 25, the site is still offline and the official statement the cofounder promised has not appeared. Below is what is confirmed, where the money went, and what players should do now.

Duelbits’ first public word came at 11:42 UTC on September 24, nearly three hours after the first funds left its wallets and almost two hours after Scam Sniffer’s first public alert. The post called it a “security incident” and gave no loss figure and no cause.

We’re currently investigating a security incident affecting the site. As a precaution, the site has been taken offline while we investigate and work to ensure it is safe to restore service.

Duelbits (@Duelbits) September 24, 2026

The Cofounder’s Statement on X

At 13:38 UTC, cofounder Joe put a number on it. He confirmed a hack of about $7 million and said the site would stay offline until the team understood what happened. Two minutes later, CEO Jasper posted that user funds were safe.

Confirming a ~$7M hack. Still investigating exactly what happened and how. Until we have clarity, Duelbits stays offline. User funds are safe. Next steps: finish the investigation, re-top hot wallets, and bring Duelbits back online, launch Duelbits 2.0. I’ll keep posting updates as I have them.

Joe (@DuelbitsJoe) September 24, 2026

At 22:38 UTC the same day, Joe said Duelbits had identified what happened and would publish an official statement within 24 hours. He estimated the site would be back within about 15 hours and said the deposit and withdrawal servers were being rebuilt.

At 11:21 UTC on September 25, Duelbits posted that it was still offline while it finished final security checks.

Quick update: we’re still offline while we finish our final security checks. We’re not reopening until everything is fully secure.

Player funds remain safe. A more detailed update is coming very soon.

Thanks for your patience and your support. We’ll be back.

Duelbits (@Duelbits) September 25, 2026

Joe’s 15 hour estimate passed about two hours later with the site still down. The post again said player funds were safe and promised a more detailed update, but gave no reopening date.

What Duelbits Has Not Said Yet

At the time of writing, the official statement has not appeared and the site is still offline. That leaves the questions players care about most unanswered:

The on chain record shows how fast it happened. The first identified transfer left a Duelbits wallet on Tron at 08:58 UTC, and the Ethereum hot wallet was emptied in under three minutes. Blockchain monitors spotted the outflows before Duelbits said anything.

The Bitcoin transaction drew on several input addresses, so the public record alone does not prove that all 8.1 BTC came from Duelbits. The other transfers come from wallets that security firms and Duelbits’ own 2024 announcement tie to the casino.

Most of the stolen tokens were swapped into ETH within hours and moved to a single new address. As of September 25, that address held about 2,334 ETH, roughly $6.3 million at the September 25 ETH price, and had sent nothing since September 24. The drained Duelbits hot wallet was left with about $25.

Swapping into ETH is a common move after a hack. Tether and Circle can freeze USDT and USDC held at a flagged address, but no issuer can freeze ETH. Researchers also note that the consolidation address received funds from other sources, so not every coin in it can be counted as Duelbits’ loss.

Wallet Addresses in the Duelbits Hack

These are the addresses tied to the September 24 transfers. Every transaction on them is public and can be checked on the block explorers linked below.

Why the Reported Loss Figures Differ

Headlines have quoted everything from $4.2 million to $7 million. The gap is not a contradiction, because each figure measured something different:

USDT shows the gap clearly. The Ethereum and BNB Chain transfers add up to 1,146,192 USDT, the figure PeckShield reported, and adding the Tron transfer brings it to 1,622,250 USDT.

We track Duelbits every month for our market report, using Tanzanite data on the wallets it attributes to each operator. The daily figures for the week of the hack show two things: deposits did not slow before the hack, and the tracked balance fell sharply on September 24.

*Partial day. Duelbits took the site offline around 11:42 UTC. Source: Tanzanite, VIP-Grinders analysis.

Watching for the Hot Wallet Refill

Joe’s recovery plan includes refilling the hot wallets before the site reopens. If the new funds go to wallets Tanzanite tracks, the balance should jump, which would be the first on chain sign that Duelbits has put fresh money in. We will add the daily figures here as they come in.

Yes. On February 13, 2024, an attacker drained about $4.6 million from Duelbits wallets on Ethereum and BNB Chain. CertiK flagged a possible private key compromise at the time, and De.Fi’s incident report put the loss at $4,643,315.

Two days later, Duelbits posted this statement on X:

Dear Duelbits Community,

In response to the recent posts, we wish to assure everyone that all Duelbits customer funds and accounts are safe and secure.

Our ETH hot wallet recently experienced a security breach, resulting in the unauthorized withdrawal of a small amount of our ETH reserve (~1700 ETH). We have alerted law enforcement and are working hard to address the situation.

However, we want to reassure the Duelbits community that the security of user accounts has not been compromised and remains our highest priority.

Despite this unfortunate incident, all our services continue to operate smoothly and without interruption.

Funds are Safu

Duelbits (@Duelbits) February 15, 2024

In the next post of the same thread, Duelbits named its new ETH hot wallet: 0x014435B1E39945CF4f5F0c3cbb5833195A95CC9B. That is the address drained on September 24, 2026. Etherscan shows the wallet was first funded in February 2024, around the time of that announcement.

The Two Duelbits Hacks Compared

What Duelbits’ Own Website Says

A page on Duelbits’ blog titled “Is Duelbits Legit?”, published on April 5, 2026, says the casino “has operated without a security breach since 2020”. Here is how its claims compare with the record:

Right now, nobody outside Duelbits can say. The site is offline, withdrawals are unavailable, and the only evidence that player balances are intact is the company’s own word.

Are Duelbits User Funds Safe?

Duelbits says yes, in posts from Joe and CEO Jasper and on its own blog. But it has published no proof of reserves, no balance snapshot and no plan for processing withdrawals.

Balances on Duelbits are custodial. Deposits are converted into the platform’s own “Bits”, so the number in your account is a claim on Duelbits, not coins sitting in a wallet you control.

Is Duelbits Down? Withdrawals and Reopening

Yes: the casino has been offline since September 24, and deposits and withdrawals are unavailable. Joe’s estimate of a return within about 15 hours has passed, and Duelbits’ September 25 update said only that it would reopen once everything was fully secure. When the site comes back, the real test is whether withdrawals go through, not whether the site loads.

What the Curacao License Covers

Duelbits is operated by Liquid Entertainment N.V. under Curacao Gaming Authority license OGL/2024/1507/0838, which can be checked on the CGA register. A license tells you which registered company is accountable, which is what separates Duelbits from unlicensed sites. It does not audit the crypto behind each player balance.

What Duelbits Players Should Do Now

If you have funds on Duelbits, these steps protect you while the site is down:

If you want to play elsewhere while Duelbits is offline, start with the crypto casinos we have tested with real money.

Duelbits is not the first crypto casino to lose millions to hackers. It is the only operator in this table to be hit twice.

Most of these incidents came down to wallet access. Attackers breached the system Stake used to authorize transactions, security firms suspect a key compromise at Duelbits both times, and MetaWin lost funds through its withdrawal system. The exception was BC.GAME, which lost $4.3 million through a third party game in March.

What separates them is the response. Stake had its affected wallets running again within hours, BC.GAME stayed online and posted a bounty, and MetaWin’s CEO said he covered the losses himself. Duelbits took its site offline and, at the time of writing, has not explained how the attacker got in.

This story is still developing. These are the things to watch:

We will update this article as new details emerge.