Gamdom faces $15m ransom over player database

• WhiteArmor lists Gamdom on its leak site and demands $15m in Bitcoin.
• The group claims 15,420,003 accounts and has set a 9 November release date.
• Founder Felix Römer disputes the scale but says player emails may be exposed.

Data extortion group WhiteArmor has listed crypto casino Gamdom on its leak site, demanding $15m in Bitcoin.

The group says it holds the operator’s full user database. Gamdom founder Felix Römer disputes the scale of the claim but has acknowledged that some player data may be exposed.

Fifteen million reasons

Threat intelligence account Dark Web Informer picked up the listing on X on 26 October. WhiteArmor says it holds 15,420,003 user accounts spread across 146 database columns.

Gamdom was founded in 2016 and offers crypto casino games, sports betting and esports wagering, according to Dark Web Informer’s summary of the listing.

WhiteArmor puts the combined profit value of the accounts at more than $1bn. It has not explained how it reached that figure.

As proof, the group posted a 100-account sample  as a JSON file of around 437KB. The listing says payment instructions will go to Gamdom by email. The listing text sets no public deadline. However, Gambling Lore reported that the page displayed a 9 November release date.

The ransom is more than three times the $4.2m that on-chain investigator vxdb estimates was drained from Gamdom’s hot wallets this month.

The key nobody changed

The group claims it got in through an internal machine account with administrative privileges. It says the account was issued years ago and its credentials were never rotated.

A machine account is a non-human login used by software and automation rather than staff. The listing names a third party it says the account belonged to, a claim that has not been verified.

WhiteArmor says that access opened up Gamdom’s control panels and stored secrets. It also takes aim at Gamdom’s provably fair games, though no technical evidence for that allegation has been published.

Two names, one ransom

WhiteArmor may not be the party holding the data. Gambling Lore spoke to a hacker using the name Veryso, who claims to have extracted roughly 15.4 million database rows on 13 October.

WhiteArmor’s founder told the outlet that the group did not have access to the full dataset. The founder credited Veryso with the extraction and said the group’s only goal was money.

Veryso also claimed to have first contacted Gamdom on 22 October, through Telegram accounts said to belong to senior administrators. According to Gambling Lore, the hacker said Gamdom had not responded.

One record checks out

Gambling Lore said it supplied a username and received a 146-field record that matched a real account opened five years ago. The record held login timestamps, an IP address, betting figures and account flags, but no identity documents.

That confirms one sample, not the claim as a whole. The full record count, the entry point and the provably fair allegation all remain unverified.

Ransomware.live advises treating the listing with caution until it is confirmed.

A shifting defence

Römer has responded on X. According to Journal du Coin, he first said his team had found no evidence of data extraction during the 13 October attack.

He said the attackers held a few hundred accounts at most, reportedly used to test withdrawals. He added that the 15 million figure did not match Gamdom’s real user numbers.

Hours later, his position moved. Journal du Coin reported that Römer acknowledged the attackers could have usernames, email addresses and players’ gains and losses. He said KYC documents were not affected.

Where the money went

The extortion bid follows a hot wallet exploit on 13 October. According to a timeline compiled by VIP-Grinders, large payments left Gamdom wallets on Ethereum, Solana, BNB Chain, Tron and the XRP Ledger over roughly an hour.

Gamdom took the platform offline that evening. It later said a suspected disk failure led staff to an unauthorised connection on one of its automation servers.

Römer confirmed the breach on X the following day.

Felix Römer, founder, Gamdom, said:

“Long story short, we noticed a breach attacking our hot wallet system & we took measures to stop the drain, in total we lost just over $3m to the breach”

Vxdb put the damage at $4.208m across eight networks, according to Cryptopolitan. Around $2.2m was taken from EVM chains, with $965,000 on Solana, $668,000 on Bitcoin and $375,000 on Tron.

Römer now accounts for that gap. Journal du Coin reported that he said attackers also took around $1m from Gamdom’s private-key systems on top of the hot wallet losses.

Blockchain investigator ZachXBT has since tied stolen Gamdom funds to FreedomXMR, a service on Hyperliquid Core. According to Cryptopolitan, more than 87% of its inflows were linked to illicit activity.

Gamdom reopened on 16 October with relaunch bonuses. It has not published a post-mortem of the incident or proof of reserves.

One attack or two

Römer believes the incidents are connected. According to Journal du Coin, he said the group behind the ransom was very probably responsible for the wallet hack.

Veryso’s claimed extraction date matches the day of the wallet exploit. Gambling Lore stressed, however, that its conversations did not establish that the same person or access route was behind both.

WhiteArmor itself is a recent arrival. Crypto.news reported that the group first appeared in HackerFeeds victim tracking on 21 October. It has since listed LoveSac, J.B. Hunt, Hisense and Whirlpool.

Trust on the line

Gamdom is now dealing with its second security crisis in a fortnight. Each revision to its account of what was taken makes the next statement harder to land.

Players are unlikely to be satisfied by partial admissions on X. A full post-mortem covering both incidents would do more to settle nerves than relaunch bonuses.

The wider sector has little room to look away. Hackers drained $7m from Duelbits in late September. A year ago, Shuffle warned users that customer data had been exposed through a third-party provider.

Curaçao’s gambling regulator, meanwhile, is scrapping its breached portal after a nine-month long attack.

If WhiteArmor’s account of the intrusion holds up, crypto operators using legacy service accounts have reason to audit them now.