Duelbits Hot Wallet Breach Leaves $7M in Question Across Five Blockchains
Duelbits swapped out its Ethereum hot wallet in response to a $4.6 million theft that occurred in 2024.
As of September 24, 2026, assets tracked from hot wallets associated with Duelbits, spanning five separate blockchains, collectively amounted to roughly $6.07 million.
One of the impacted wallets was the Ethereum address Duelbits had made public following the 2024 incident.
Duelbits co-founder Joe estimated the loss to be around $7 million.
Blockchain analysts monitored asset flows on Ethereum, BNB Chain, and Tron, while also pinpointing recipient addresses on Bitcoin and Solana.
The cumulative value of these cross-chain transfers, calculated with prices used at the time of analysis, comes to about $6.1 million, though this figure doesn’t perfectly match Joe’s public statement.
Scam Sniffer classified the outflows as likely stemming from a private key compromise.
Joe pledged to deliver an explanation within a day and anticipated a rapid resumption of services.
Joe later updated that the platform would remain offline longer while Duelbits carried out security measures and replenished its wallets. On September 27, Duelbits announced the relaunch of its site, restoring deposit and withdrawal functions.
In an April 5, 2026, blog entry, Duelbits stated under “Track record”: “Duelbits has operated since 2020. No security breaches, hacks, or unauthorised fund access incidents have been reported in that time.”
This assertion conflicted with the company’s own February 2024 admission of a “security breach” and “unauthorized withdrawal” from its Ethereum hot wallet.
This inconsistency brings renewed attention to the prior breach and invites scrutiny regarding the steps Duelbits took after it.
What specific changes were implemented by Duelbits after the initial theft, and how did unauthorized access occur again with the replacement wallet?
Credit: CertiK, CoinDesk, DuelbitsJoe, Scam Sniffer, Duelbits, Specter, PeckShield, The Defiant, ChainBounty
At 08:58 UTC on September 24, 476,058 USDT was transferred out of a Tron wallet that Scam Sniffer attributed to Duelbits.
One minute later, at 08:59 UTC, 552,762 USDT exited a Duelbits hot wallet on BNB Chain. Duelbits had previously listed this wallet as its new Ethereum hot wallet following the 2024 incident.
Subsequent transfers from that wallet on Ethereum included 593,430 USDT, 96,805 USDC, 31,515 DAI, and around 12.4 billion SHIB. At 09:02:47 UTC, the wallet sent 836 ETH.
The three USDT transfers on Tron, BNB Chain, and Ethereum totaled about $1.62 million USDT, the figure cited by Scam Sniffer.
At 09:42 UTC, 8.09987887 BTC landed at an address highlighted in Specter’s investigation.
At 9:52 UTC, Scam Sniffer reported approximately $4.2 million in outflows from Duelbits hot wallets across Ethereum, BNB Chain, and Tron, again noting suspicion of a private key leak.
Subsequent estimates varied as more details emerged.
At 10:15, PeckShield assessed the loss at about $4.3 million on Ethereum and BNB Chain, noting the assets had been exchanged for 1,587.87 ETH and 31,500 DAI.
At 10:28, Specter revised the total to roughly $4.9 million after factoring in over $600,000 in Bitcoin; Scam Sniffer’s update gave a similar estimate with about 8.1 BTC included.
By 11:42, CertiK identified nearly $6 million in questionable outflows, referencing the approximate $4.6 million incident from February 2024.
At the same time, Duelbits announced it was investigating "a security incident" and had taken the platform offline as a safeguard.
The statement did not provide an exact loss figure or an explanation of how the funds were accessed, nearly three hours after the initial flagged transaction.
Joe reassured users Duelbits would return "asap" at 12:43 UTC.
At 13:38, Joe confirmed “a ~$7M hack”, stated that the team was “still investigating exactly what happened and how,” and maintained that user funds remained unaffected.
He outlined plans to launch Duelbits 2.0, an upgrade previously promoted two days before.
These numbers represent a progression of estimates rather than a definitive reconciliation.
Duelbits did not disclose a detailed breakdown by chain or clarify the method of compromise in public statements issued on September 24.
If the access method has not been publicly explained, what can be inferred from the transaction history of the affected addresses?
Return Address
Scam Sniffer characterized the September 2026 asset movements as likely due to a "private key compromise".
SlowMist’s incident database records "Private Key Leakage" as the method of attack.
However, without direct evidence, it is not confirmed that a private key was directly exfiltrated. The blockchain activity only shows that funds were transferred, not the precise mechanism used to enable those transfers.
Tron, BNB Chain, and Ethereum record outflows, but the timing does not clarify the original point of compromise.
Later that day, Joe announced Duelbits had "identified what happened" and promised further details within 24 hours. He also stated the team was rebuilding critical infrastructure for security. He added, "A few people ruined it for everyone else," but did not elaborate on who was involved or their role.
This lack of transparency is notable since this was not the platform’s first security incident. Back in February 2024, CertiK reported that $4.6 million had been taken from Duelbits and raised the possibility of a private-key leak.
Duelbits later confirmed its ETH hot wallet had suffered a "security breach" resulting in an "unauthorized withdrawal" and disclosed a new ETH hot wallet address.
The same replacement address was central to the Ethereum and BNB Chain movements in September 2026.
While this address match does not prove the same attacker or attack vector was involved both times, it does make the question of what Duelbits changed after the earlier breach especially pressing.
This contradiction is heightened by Duelbits’ April 2026 claim of no breaches since 2020, despite their own admission of a hot wallet breach in February 2024.
Understanding what, if anything, was updated or failed in their security process remains essential.
The attack vector has not been conclusively identified, but the subsequent disposition of the assets is better documented.
While Duelbits has kept quiet on how the attacker obtained access, analysis of on-chain activity reveals what happened to the stolen funds.
Cashing Out
The Ethereum and BNB Chain assets were funneled into a common recipient address.
CertiK also identified recipient addresses on Tron, Bitcoin, and Solana, but the value moved to each address was not always clear from the addresses alone.
Analysis of transaction histories shows that Ethereum and BNB Chain assets ended up in a single wallet, while Tron and Solana assets were sent to separate wallets, and approximately 8.1 BTC was directed to a specific Bitcoin address.
Duelbits Hot Wallet (Ethereum / BNB Chain sender):
0x014435B1E39945CF4f5F0c3cbb5833195A95CC9B
Ethereum First Recipient:
0xA77e24Fe29d16E051e487ef4Ea7b056cb05aef76
BNB Chain Recipient:
0xA77e24Fe29d16E051e487ef4Ea7b056cb05aef76
The Ethereum recipient collected 836 ETH, 593,430.32 USDT, 96,804.68 USDC, 31,515 DAI, and approximately 12.4 billion SHIB.
On BNB Chain, the same address received 209 BNB and 552,761.72866981 Binance-Peg USDT.
PeckShield listed the same amounts of Ethereum and BNB Chain assets using rounded figures.
Ethereum Transfer (836 ETH):
0xcdc0b6dfacbefe4aef640be1538c9081bbf401ca9ad9784e1b0cfc044523182d
Ethereum Transfer (593,430.32 USDT):
0x4f2bc2a8bc5040788c71e712546deec6d0f61529518b8114b0334ffd3e9bb739
Ethereum Transfer (96,804.68 USDC):
0xf9cd780608100fad136e4cb9a334c4faa6cd4fd4f0007bd4b6334ba71128eedf
Ethereum Transfer (31,515 DAI):
0x9ded7a9c5a4d1f4f1aa06d972bb423ce5f186d436d229727a185b4279d4fd746
Ethereum Transfer (about 12.4 billion SHIB):
0x0ef345e1d19cfef9e46517b5d7d9dba2c25893a90f548a92dc964cdab1caf3f7
BNB Chain Transfer (552,761.72866981 BUSD-T):
0x0a79ed0be9a608f623bb1e12d2e8e811237d0c87b396373f7d6f1aa1f78bb885
BNB Chain Transfer (209 BNB):
0x56477897e9510c50fe561bf5eaac33a32762af43e42b546011cca6ae4f3b1cd1
The Tron recipient obtained 476,058.087528 USDT and 192,470 TRX from the Duelbits-attributed wallet.
On Solana, the wallet under investigation received 5,325.764 SOL, 397,880.061828 USDC, and 44,850 TRUMP from a wallet labeled Duelbits in Solscan.
The largest individual Solana receipts were 5,294 SOL, 396,514 USDC, and 44,850 TRUMP, but there were smaller transfers as well.
Duelbits Hot Wallet on Tron:
THqFmhAPcdHECH3wmrpZv4MWAB2v9TY1oN
Tron Recipient (as per CertiK): TAvraZZFCZbDSZoyqWWRRsBkFgZqKaCGbK
Tron Transfer (476,058.087528 USDT):
2793e4b8ab5f8abc3bc461ba45b19d2ea247831be8afb6d1e8068e81ad2a9e2d
Tron Transfer (192,470 TRX):
e6d138b8f44c0fab7459f3616f71f933c885d2dabd83ea30fdaa7c184421146a
Duelbits Hot Wallet on Solana:
FoxqdkGRDZstVFA3wAyLnhua5ZB7jpoE36L3kcUAMqf4
Solana Recipient (per CertiK):
A3EBrhMBEGzcPgmbwywSPhW39G6PFGrorU8ib99T6yKw
Solana Transfer (5,294 SOL):
5nUNaY8UA3AFe4BzQLnP5Ly6iNqxENtVCsc1ThPVcayyc27Xzx7qnEFy19VnaeT6nubkAJd6QzHq1CwBkNyPgna3
Solana Transfer (396,514 USDC):
2r2noXY8xgPPXaPFE7toBrkijRgBBJoVdcySz7qXXhjod9ESuh6h7KrwZFevUq8sUXzaR4wvrTXaaEF3zWSQ8fWx
Solana Transfer (44,850 TRUMP):
5n47G7vB5oKcLpXthW3oh6uz4Kh3SnEqufzJq5sqDoFjD1BW3gY7uqpsbbmdj9eMxLCpZyHzC8TPb2AbzrRsqkjN
The Bitcoin transaction aggregated 121 inputs. Arkham attributes all of them to Duelbits, and Scam Sniffer described the transaction as an approximately 8.1 BTC outflow from a Duelbits hot wallet on Bitcoin.
Of the two Bitcoin outputs, 8.09987887 BTC was sent to the address flagged by CertiK; the other output, 0.01132036 BTC, went to a different address also labeled as Duelbits by Arkham.
Bitcoin Recipient (per CertiK):
bc1qhtu84kz3y94lvgl2t05zk84tqh57grvd82zvcl
Bitcoin Transfer (8.09987887 BTC):
159e274755432366d2589ef7ed809c440b262ed2e23277ca8d4a2bcd506bf221
Other Bitcoin Output (0.01132036 BTC; Arkham-labeled Duelbits address):
bc1qe8w33uzvd5jyxmnfq37cx2nts67p29myudxcud
The total value of the identified receipts is around $5.39 million excluding Bitcoin. Including the 8.09987887 BTC increases the estimate to about $6.07 million.
Arkham marked all 121 Bitcoin transaction inputs as tied to Duelbits.
These totals reflect the traceable assets in this review rather than an independent reproduction of CertiK’s loss figure or a full reconciliation of Joe’s $7 million claim.
A significant portion of the funds was converted into other tokens. PeckShield noted that Ethereum and BNB Chain assets had been swapped for 1,587.87 ETH and 31,500 DAI.
The DAI was later exchanged; The Defiant reported that 31,515 DAI was converted into about 11.78 ETH after fees.
Assets moved between chains, which could also lead to double counting. Seven BNB Chain-to-Ethereum deBridge transactions marked as “Fulfilled And Unlocked” credited a combined 263.469264 ETH to the recipient.
Etherscan’s internal transactions log lists seven matching ETH credits from the deBridge contract to the first Ethereum recipient. The total is based on deBridge’s six-decimal outputs; Etherscan rounds the display for the address.
BNB Chain deBridge Route 1:
0x44888e81ce15e6506b8453700fb0c1458402aee62d3422338db393bb06d2f830
Ethereum deBridge Route 1 (56.56 ETH):
0xd09102d4d040bd7429be6f4aba72e075c884b35b275fa39e524236717ce6325f
BNB Chain deBridge Route 2:
0x9e4d9a5f4af709b28e7bfd0de80ba5fdf93bfbaa6c2be84dfdb01f6acffae521
Ethereum deBridge Route 2 (about 19.76 ETH):
0x4b3398ce505afd8e5788317b7590764b3f7ce05c53736affe77af684bc73ade5
BNB Chain deBridge Route 3:
0xfa12bfc97faa90d025a141d1b7f0184b57e1cf0ad2dde275df1acb6cc2a62b5e
Ethereum deBridge Route 3 (about 37.43 ETH):
0x2a4c0ee05d2ab1f031d07d9786a9f417f395ab5e0e4855d89abeabfb7261fa5b
BNB Chain deBridge Route 4:
0xb3f870c7d217283a3e7f742b7f82373bf33057822a8f944d483eabd663f1ee3f
Ethereum deBridge Route 4 (about 37.42 ETH):
0xf8708726bfe26da8ffffd7c0ab22ef51425b491020d224a4ffa5521dd5690eeb
BNB Chain deBridge Route 5:
0x0a8f247b3606553b7cfc12206e19b0c0983ac586a73e5d06ef2d63a4b97e62af
Ethereum deBridge Route 5 (about 37.45 ETH):
0x3a74f502ab30ae8b63bdca40acf567ea02b27fbab1d6de5dbe17c10b57a6226f
BNB Chain deBridge Route 6:
0x23fce58e28878ec95e16ca0c38043f248e6a0cb2b1410345ad7c6d2add162843
Ethereum deBridge Route 6 (about 37.45 ETH):
0x9c0b4a5164c08e040df8062b546dc6c3b191c3663b1ee7ffce24cbf6766a070b
BNB Chain deBridge Route 7:
0x2f2b0f45609bcd5ffd823fbf1887142a62aa209f03a1db200e44af60d06c3b99
Ethereum deBridge Route 7 (about 37.40 ETH):
0xec624f7e38a59e9813d53686201057f581197c943495eb83b547635545734420
The Tron recipient later exchanged its USDT for 1,396,632.284029 TRX on SunSwap.
Tron SunSwap Transaction (1,396,632.284029 TRX to recipient):
8f948ee9c3a6e04e5ebf72115b8724ac63eb1648b4dec1b16b926ec344fd75cc
On Solana, the recipient exchanged portions of its USDC and TRUMP for wrapped SOL (WSOL). Solscan’s activity log lists six swaps across five transaction signatures; two TRUMP swaps share a signature. These are conversions of previously received assets.
Solana Swap (100,000 USDC → 877.771263845 WSOL):
4dX4pK1QTUK5SdtEK2S3k3FwrMemDVtDNCFJ5TZbDfWdejjs5ZMHwWqHdKNDWMEt9N94hx5iT9zbGNrCEJKsK6V8
Solana Swap (24,850 TRUMP → 429.25583428 WSOL):
25wPGtTNG4EAHwUXWLtL8EU2D5zxzzAAAYFBuS1EYR85gW25oTTyRqZKaTCje33ZCTBXmZk9bMuQ1SUEr1LFSaUQ
Solana Swap (19,970 TRUMP → 345.232520312 WSOL; same tx also lists 30 TRUMP → 59.213033 USDC):
f2Z8pTrbEushH3hVfm4VCqs5cPRkSV7koSNqVn6tFvZZVBvMbqr89fiPoXmCn7KYDmdmqGiRjD8aGDB84Zo8T1j
Solana Swap (1,342.08714 USDC → 11.820142938 WSOL):
3M32crzuMaWNfc4GHrv3zMhJPhNoTZfkm5w7va1Japd7HKuKTRjHsfGj2exdkpBSgeUTM8YmSWvD5DPEJjneFpHo
Solana Swap (23.974688 USDC → 0.211772304 WSOL):
2jvfyS2YtqN8hjD9C45wyY39rrXr1C8kbXYMqnNJEAEsDDqER1JDn7UvkScZMw9W8kE9EYGfo13vdBVnkaxUizpa
A majority of the ETH was collected into a consolidation wallet. Transaction records show the first Ethereum recipient transferring 1,577.88 ETH to an intermediary, which then distributed large sums to a final consolidation address.
First Ethereum Recipient → Intermediary (1,577.88 ETH):
0x4fa5a3bcef68c24d1ea0c4b0eb39d0e46575e075539bec9a66fa0852ff2b0496
CoinDesk reported about 2,234 ETH at that address on September 24. At the time, the ETH was unmoved, but subsequently, funds were sent to other wallets.
Ethereum Intermediary:
0x181A638038A4bD75c207d080DE83e217f8e8a1d7
First Recipient → Ethereum Intermediary (1,577.88 ETH):
0x4fa5a3bcef68c24d1ea0c4b0eb39d0e46575e075539bec9a66fa0852ff2b0496
Consolidation Address:
0x8dB9D7f0a03d212c566Ca80c66e294CeCC20C306
A ChainBounty community investigation tracked 20 Tornado Cash deposits totaling 1,370 ETH from wallets linked to the consolidation address.
Across all five chains, the traced asset receipts sum to approximately $6.07 million.
Duelbits announced the platform’s return on September 26. However, reopening did not clarify the fate of the missing funds.
What did the relaunch actually demonstrate?
Topped Up
Duelbits' post-incident plan included four main steps, as Joe outlined on the first day: Complete the investigation, replenish hot wallets, restore the site, and roll out Duelbits 2.0.
Duelbits communicated that hot wallets had been refilled, and the platform was back online, albeit later than initially estimated.
No findings from the internal investigation have been disclosed, and Duelbits was still describing 2.0 as upcoming at the time of reopening.
At 22:38 UTC on September 24, Joe said the site would be restored within about 15 hours, urging followers to “ignore the FUD” and promising a stronger return.
The next day, Duelbits’ official account reported that the site remained offline for “final security checks”, with a more detailed update forthcoming.
That afternoon, Joe apologized for further delays, stating that wallets were being topped up and that withdrawals would be available immediately upon relaunch. He also indicated Duelbits 2.0 was scheduled for early October.
On September 25, Joe shared three wallet addresses he said would be used to restore the hot wallets, with replenishment totaling around $8 million.
ETH + stables (2,000 ETH):
0xB62C7836500A4E13dAeF19Da7a25D04c8a5F7eC0
500 ETH was sent to another Duelbits wallet:
0x1c525A31E90AF0Bb379c708aB6bE84eF9248ec94
SOL + stables (5,703 SOL):
ANh1jaSqmhSzCX2YBsvNBecBNRBqcJuztgzv1gzMXiNy
5,702 SOL was sent to another Duelbits wallet:
FkHGJmNX943Sz9ww7J7BndT2j3AG3fKA4cSZd3wTJo8g
BNB + stables (~400K B-USD and 128.5 BNB):
0x304715b278a2f9B08c1944B1E7e2750ba5Bf0b70
All BNB funds moved to another Duelbits wallet:
0x1c525A31E90AF0Bb379c708aB6bE84eF9248ec94
Publishing replenishment wallet addresses represents a transparency step, but is not equivalent to an audited proof-of-reserves. These wallets are those Duelbits said would be used to fund operations, but they do not indicate the company’s liabilities to customers.
At 05:04 UTC on September 27, Duelbits announced the platform’s return. Deposits and withdrawals were re-enabled, and the team said they used the additional downtime to thoroughly rebuild and test infrastructure, with about $8 million distributed between hot and cold wallets “ready to pay out.”
Users were notified: “Deposit addresses have changed. Always get your new one from your account.”
Although Joe had promised an official explanation within 24 hours on September 24, this statement was still absent when the site reopened. In a follow-up statement on September 27, Joe said he was “working on an official explanation,” and remarked that attention only comes when “stuff hits the fan.”
As of October 2, there has been no public investigation report or detailed asset tracing by chain.
What customers have received are public assurances. Both Joe and the official account affirmed user balances were protected.
The same article states that no breaches have occurred since 2020.
However, Duelbits itself reported a breach in February 2024, including the announcement that it would rotate its Ethereum hot wallet after losing approximately $4.6 million to attackers.
This April 2026 claim therefore stands at odds with Duelbits’ earlier public disclosures.
For those who prefer verification over trust, such discrepancies are troubling.
If operational relaunch proves Duelbits is running, what evidence is there that lessons have been learned from two major thefts?
The reuse of a replacement address across two hacks, with no public post-mortem, leaves open questions about what improvements were made.
Duelbits acted swiftly on operational matters.
They took the platform offline, published wallet addresses for hot wallet replenishment, and said they had restored operations with about $8 million in combined hot and cold storage.
What remains unaddressed is how the attacker gained access to the post-2024 replacement wallet.
Security experts suspect a private-key leak, but Duelbits has not clarified the actual cause. The detailed explanation Joe promised within 24 hours was still missing as of October 2.
Players are left with this unresolved record: A company making rapid operational responses to security breaches even as its marketing claims no such incidents ever happened.
The main issue is not just what Duelbits has yet to explain, but the discrepancy between its public statements and its own documented history.
If a gaming site promises provable fairness for every bet, why should its security record be the one thing players are expected to trust without verification?
Get new scam files the moment we publish them — usually 2–3 emails a week.