The Duelbits hack on September 24, 2026 is a useful warning for anyone who keeps a poker bankroll in crypto. The crypto casino and sports betting platform suspended operations after attackers drained an estimated $7 million from its hot wallets across multiple blockchain networks. Duelbits is not a poker room, but the way the incident unfolded raises questions that every crypto poker player should ask about the sites they use. This article walks through what was reported, what is still uncertain, and the practical steps that reduce your exposure.
What happened
According to Crypto Briefing, Duelbits went offline after hackers drained funds from its hot wallets on September 24. Initial reports put losses at about $4.2 million across Ethereum, BNB Chain and Tron. As investigators counted outflows from Bitcoin and Solana wallets, the estimate climbed toward $7 million.
The reported haul included 836 ETH, 1.62 million USDT, 97,000 USDC, 209 BNB and 192,000 TRX, plus smaller Bitcoin and Solana flows. The suspected cause was a private key compromise, described as a private key leak tied to the platform's hot wallets. The article presents both the $7 million figure and the root cause as estimates and suspicions, so details may change as investigators confirm what happened.
After the theft, funds moved to newly created wallet addresses. Most stolen tokens were quickly converted to ETH and moved through cross-chain bridges and swap protocols, a standard laundering pattern that makes recovery difficult.
A repeat incident
This was not the first time. Duelbits suffered a similar wallet drain in February 2024, losing about $4.6 million. Crypto Briefing puts the two breaches at roughly $11.6 million combined. A second large theft within about two and a half years points to a structural issue with how the platform secures its operational wallets, rather than a one-off accident. That is an inference, and the company has not published a full post-mortem as of the reports we reviewed.
What the company says
A Duelbits co-founder said user funds remain safe and that the platform plans to replenish its hot wallets and relaunch. The platform says it keeps operational hot wallets separate from user reserves, which are held in cold storage. The site is licensed by the Curacao Gaming Authority.
Those statements, if accurate, describe the architecture that crypto gambling operators are supposed to have: a small hot wallet for day-to-day withdrawals and the bulk of reserves offline. The problem for customers is verification. Players cannot audit a cold-storage claim on their own, and a Curacao licence does not carry the consumer protection expectations of a regulator in a major market. The distinction between "user funds are safe" and "user funds are insured and guaranteed" is important.
Why poker players should care
Many crypto-friendly rooms use the same custody model: pooled wallets, a hot wallet for payouts, and reserves elsewhere. If you keep a sizable balance on a poker site, you are an unsecured creditor of the operator in practice. The Duelbits incident shows how quickly a key compromise can halt withdrawals, even when the operator insists customer money is untouched.
It also shows how the burden of proof sits with the customer. Anything the operator says about cold storage is a claim, not something you can check. Industry practice has begun to include proof-of-reserves reports and independent audits, but these are not universal in online poker.
A practical checklist for crypto bankrolls
You cannot eliminate risk, but you can limit it.
- Keep a working bankroll on site, not your savings. Withdraw winnings regularly. Our bankroll management guide explains how to size your roll; the on-site portion should be only what you need for your current stakes.
- Withdraw often. A hot wallet that has just been drained will freeze payouts. The less you have sitting on a site, the less is exposed.
- Use a personal wallet you control. Send withdrawals to a wallet whose keys you hold, not to another exchange account you do not control.
- Check the licence and track record. Our safe poker sites list compares operators on licensing, payout history and transparency.
- Look for provable fairness and reserve transparency. Crypto poker rooms vary widely; see our explainer on bitcoin poker for how deposits and withdrawals typically work.
- Enable every account protection available. Use two-factor authentication on the poker account and on your own wallets.
If you want to see how a crypto-native room positions itself, read our BC Poker review, which covers its Anjouan licence and provably fair shuffle. Licence jurisdictions differ and none of them removes the need to manage your own exposure.
The wider pattern in crypto gambling
Crypto casinos have been a repeated target because they hold large pools of liquid assets and operate across multiple chains, which multiplies the number of keys and systems to defend. Each chain adds an operational burden: separate wallets, separate monitoring, separate procedures. A platform that supports Ethereum, BNB Chain, Tron, Bitcoin and Solana, as the stolen-asset list suggests Duelbits does, has a larger attack surface than one supporting a single coin.
For poker rooms, the same logic applies. Crypto poker has grown because it offers fast withdrawals, borderless access and lower friction for US players than card payments. That convenience carries a trade-off. Fiat payment processors provide chargeback rights and regulatory recourse; crypto transfers are final. If a site is hacked or fails, there is no card issuer to dispute the charge.
How to read an operator's response
When a hack happens, watch how the operator behaves. Good signs include a prompt public statement, clear information about which wallets were affected, a timeline for withdrawals, and an independent review. Red flags include vague wording, shifting loss figures that are never reconciled, and silence about whether customers will be reimbursed.
The Duelbits case is still developing. The company's claim that user funds are safe will be tested when withdrawals resume. Players with balances on the platform should watch official channels and be wary of phishing messages that exploit the news; scammers often impersonate support during incidents like this.
What this means for players
Treat any crypto gambling site as a counterparty with risk. Hold only what you need to play, withdraw profits on a schedule, and choose rooms with a track record and transparent practices. For US players weighing options, compare crypto-friendly rooms on our payments page and our US poker sites list. If a site cannot explain how it protects player funds in plain language, that is information in itself.
The Duelbits breach is a reminder that the biggest threat to a poker bankroll is not always variance. Sometimes it is operational security you cannot see. Plan accordingly, and keep your money moving.