Gamdom and Duelbits, two crypto casinos, lost just over $10 million from their hot wallets within 19 days. Neither loss came from a game. Duelbits confirmed a hack of about $7 million on 24 September 2026. Gamdom put its loss at just over $3 million after a breach that it detected on 13 October. Both companies said user funds were safe. Their licence status reads very differently from one register to the next. Duelbits holds an active Curacao licence. Gamdom holds an Anjouan licence and no active Curacao one. Four European countries list domains of one or both brands as unlicensed.
What happened at Duelbits and Gamdom
The Duelbits incident started early on 24 September 2026. At 09:52 UTC the blockchain security firm Scam Sniffer reported about $4.2 million in outflows from Duelbits hot wallets on Ethereum, BNB Chain and Tron. It described the pattern as a suspected private key compromise. Two hours later Duelbits took the site offline and said it was investigating a security incident. At 13:38 UTC co-founder Joe confirmed a hack of about $7 million.
Gamdom went offline on 13 October 2026. The next morning the company said it had first detected what looked like a disk failure. It then found an unauthorized connection on one of its automation servers and took all systems offline. On 14 October founder Felix Romer wrote that the breach targeted the hot wallet system. In total the company lost just over $3 million, and it moved its remaining hot wallet funds to cold wallets.
| Duelbits | Gamdom | |
|---|---|---|
| Date the company went offline | 24 September 2026 | 13 October 2026 |
| Loss in the company’s own words | about $7 million | just over $3 million |
| Point of entry named so far | none published, Scam Sniffer suspects a private key compromise | unauthorized connection on an automation server |
| Company statement on player balances | user funds are safe | user funds are safe |
A hot wallet is the online wallet a crypto casino keeps funded so withdrawals go out fast. Whoever controls its keys can move the money. Both breaches hit that wallet. That is why the size of a hot wallet matters to players as much as to the operator.
Duelbits licence status in the registers
Duelbits holds an active licence from the Curacao Gaming Authority. The CGA licence page lists duelbits.com and duelbits.net under Liquid Entertainment N.V., licence OGL/2024/1507/0838, status Active, granted on 1 November 2024. A second record sits in the Anjouan register. It covers duelbits.io under Elevated Entertainment Ltd, licence ALSI-112310013-FI5, issued on 13 October 2023. Its expiry date is 12 October 2026. On 18 October the register still showed that record as valid.
Three European regulators list Duelbits as unlicensed in their markets.
- France. The ANJ block list of illegal gambling sites includes duelbits.com, duelbits.fr, help.duelbits.com and news.duelbits.com.
- Latvia. The VID list of unlicensed interactive gambling sites includes duelbits.com.
- Bulgaria. The NRA black list of unlicensed gambling sites includes duelbits.com.
Gamdom licence status in the registers
The gamdom.com licence comes from Anjouan. The Anjouan register lists gamdom.com under Moon Revolution Limitada, licence ALSI-152406043-FI4, status valid, issued on 30 June 2024. It expires on 29 June 2027. Our Curacao data shows seven Gamdom web addresses with the CGA status removed from the registry. They are gamdom.com, gamdom.eu, gamdom.io, gamdom.one, gamdom.vip, gamdom.win and trgamdom.com. None of them appears under an active Curacao licence.
Three European regulators block Gamdom domains.
- Latvia. The VID list includes all seven of the web addresses above.
- Bulgaria. The NRA black list includes gamdom.com, gamdom.io and gamdom.casino.
- Czech Republic. The block list of the Ministry of Finance includes gamdom.com, gamdom.eu and gamdom.net.
What the registers tell a player after a hack
A licence decides which regulator a player can turn to when withdrawals stop. The rules on player funds also come from that regulator. A licence from one jurisdiction does not reach players in another. In Latvia, Bulgaria, the Czech Republic and France the block lists say the same thing about both brands. No local regulator stands behind them in those markets. The Curacao license check page and the Anjouan license check page explain what each regime covers and where its registers sit.
How to check a crypto casino before you deposit
- Copy the exact web address from your browser, including the ending such as .com or .io.
- Type the brand into the search box on our homepage. It shows every register and block list that names it.
- Open the regulator link on the result and confirm the licence holder, the status and the expiry date at the source.
- Check that the web address you use is one of the domains listed under the licence. Sister domains are often licensed separately or not at all.
- Check the block list of the country you live in. A brand on that list holds no local licence there.
The full method, with the red flags to watch for, is in our guide on how to check if an online casino is licensed.