Gamdom temporarily shuts down after $2.3m leaves hot wallets

• Gamdom took all systems offline after finding an unauthorised connection on an automation server.
• FairGambling reported more than $2.3m leaving Gamdom hot wallets hours before the outage.
• Another crypto platform, Duelbits, lost about $7m to hackers in September, its second breach since 2024.

Gamdom has taken its entire platform offline after finding an unauthorised connection on one of its automation servers.

The crypto casino disclosed the incident on X early on 14 October and said user funds are safe. It has not confirmed a hack or any loss of funds.

The site went down on the evening of 13 October, according to FairGambling. Players cannot reach their balances for as long as it stays offline.

A disk alarm turns serious

Gamdom said staff were checking a suspected disk failure on one server when they found the unauthorised connection on a separate automation server.

Gamdom said in the post on X:

“Approximately 24 hours ago, we detected a potential disk failure on one of our servers. During our investigation, we identified an unauthorized connection on one of our automation servers, which prompted further investigation.”

That puts the first alert early on 13 October. The company then switched off every system it runs.

It added:

“As a precautionary measure, we made the difficult decision to take all of our systems offline in order to fully assess the situation and protect our users.”

The platform confirmed in the same X post that “User funds are safe” and urged players to have patience while they “restore services as quickly and securely as possible.”

Five chains, one hour

Gamdom has not said what the automation server does or what the connection reached. It has not said whether player data was exposed or when the site will return.

Independent tracker FairGambling spotted unusual activity. It reported that Gamdom’s hot wallets sent more than $2.3m between about 15:50 and 16:50 UTC on 13 October.

Each hot wallet on Ethereum, Solana, BNB Chain, Tron and the XRP Ledger made a large payment to a single wallet on the same chain. At least four of those five wallets had never been used before Gamdom paid them, according to FairGambling.

Gamdom posted its short message on X at 18:45 UTC, about two hours later, saying the site was offline. That post gave no reason.

A switch to DAI

FairGambling’s tracker put Gamdom’s hot-wallet holdings at $10.5m on 12 October and about $76,000 a day later. On-chain outflows alone do not prove theft. Operators routinely move funds to cold storage, and the data cannot show who controls the receiving wallets.

FairGambling reported that the Ethereum wallet took in about $1.2m and converted its USDT and USDC into DAI within minutes. Tether and Circle can freeze their tokens. DAI has no built-in freeze function.

By 01:35 UTC on 14 October, two of the receiving Ethereum wallets held about $2m between them, mostly in DAI, FairGambling said.

Gamdom has not said whether it authorised the transfers, and its statement does not connect them to the unauthorised connection.

Three scares in three months

Gamdom is one of the sector’s biggest brands. FairGambling’s data for 31 August to 6 September ranked it fourth among crypto casinos for both on-chain deposits, at $55.5m, and wagers, at $534.3m.

Duelbits lost about $7m from its hot wallets to hackers in September. Co-founder Joe confirmed the loss on 24 September. The site reopened on 27 September with about $8m across hot and cold wallets.

Duelbits has not published a root cause. Monitoring service Scam Sniffer flagged a suspected private-key compromise. The casino had already lost about $4.6m in an earlier drain in February 2024.

In August, Rollbit’s tracked hot wallets fell 97% in a week, from $29.2m to about $765,000, according to FairGambling. Staff said the casino was moving funds onto new chains. Withdrawals kept processing and no hack was confirmed.

Bigger targets, wider gaps

The best-known hacking case remains Stake. The FBI blamed North Korea’s Lazarus Group for the theft of about $41m from its hot wallets in September 2023.

Suppliers can be the way in. In another incident, crypto platform Shuffle told customers in 2025 that their data was exposed through a breach at a third-party provider.

Regulators are not immune either. The Curaçao Gaming Authority is replacing its licensing portal after hackers broke into it and exposed all of its sensitive data, including passport numbers of and home addresses, corporate records, and other sensitive documents of all license holders and the companies behind them.

What links these cases is access. Attackers go after whoever holds the keys or the customer data: the operator, a supplier or a regulator.

Why hot wallets break

Crypto casinos use instant withdrawals. To pay out in seconds, they keep funded hot wallets whose private keys sit on internet-connected servers. Software signs each payout automatically, with no person approving it.

Well-run operators keep most reserves in cold storage, offline and usually behind multi-signature approval. Hot wallets hold only enough for day-to-day payouts, which limits what one breach can take.

Anyone who obtains a hot wallet key can move its funds. Blockchain transfers cannot be reversed, and there is no card scheme or bank to block a suspicious payment.

Minutes, not days

Stolen funds tend to move quickly. Decentralised exchanges can turn freezable stablecoins into assets like DAI in minutes. Bridges then carry them to other chains. FairGambling’s trace shows both steps in the Gamdom transfers, though no theft has been confirmed.

That leaves operators very little time. Detection, escalation and the decision to shut down all have to happen in less time than it takes to empty a hot wallet.

Public blockchains mean trackers often see large outflows before the operator speaks. Players can watch the same data, so a thin statement can prompt mass player withdrawals the moment a site reopens.

Licensing adds another layer. Many crypto-first casinos operate under offshore licences, and independent reviews list Gamdom’s as issued by Anjouan. The UK Gambling Commission, by contrast, requires remote operators to commission annual independent security audits.

Four unanswered questions

Gamdom’s message to players gives no detail. Duelbits made the same promise in September. It then published the addresses of its refilled wallets so trackers could check the balances, and reopened within three days.

Gamdom now has four questions to answer:

• how the connection was made
• which systems and data it touched
• whether it authorised the $2.3m in transfers
• and when players can withdraw.

Its business partners will want the same answers. So will the streamers whose referral codes send players to a site that is currently dark.