Rekt - Duelbits - Rekt

What it is

On 24 September 2026, hot wallets linked to the crypto casino Duelbits were drained across Ethereum, BNB Chain, Tron, Solana and Bitcoin. Rekt traced about $6.07 million (about $5.39 million excluding Bitcoin). Co-founder Joe said about $7 million, and Rekt says its figures do not reconcile to that. The page's main point is that the drained Ethereum and BNB Chain address, 0x014435B1E39945CF4f5F0c3cbb5833195A95CC9B, is the one Duelbits announced as its replacement hot wallet after the February 2024 breach (about $4.6 million, per CertiK).

How it works

The access route is unknown. Scam Sniffer called it a suspected private-key compromise, and SlowMist lists "Private Key Leakage". Rekt notes that neither establishes that a key was extracted. The address match does not show the same attacker or access route as in 2024.

Timeline (UTC, 24 September):

• 08:58: 476,058 USDT leaves a Tron wallet.
• 08:59: 552,762 USDT leaves BNB Chain.
• Ethereum follows: 593,430 USDT, 96,805 USDC, 31,515 DAI, about 12.4 billion SHIB and 836 ETH.
• 09:42: 8.09987887 BTC moves in one transaction with 121 inputs, all labelled Duelbits by Arkham.
• 11:42: Duelbits announces "a security incident", with no figure and no cause.

Laundering path:

flowchart LR
  A[Hot wallets on 5 chains] --> B[ETH and BNB recipient 0xA77e...]
  A --> C[Tron, Solana, BTC recipients]
  B -->|deBridge, 263.469 ETH back from BNB| B
  B -->|1,577.88 ETH| D[Intermediary 0x181A...]
  D --> E[Consolidation 0x8dB9...]
  E --> F[Tornado Cash]

• The Ethereum and BNB Chain assets went to one recipient, 0xA77e24Fe29d16E051e487ef4Ea7b056cb05aef76.
• BNB Chain assets were bridged to Ethereum in seven deBridge orders totalling 263.469264 ETH.
• Tron USDT went through SunSwap and returned 1,396,632.284029 TRX.
• Solana USDC and TRUMP were swapped into wrapped SOL.
• PeckShield said the Ethereum and BNB Chain assets had become 1,587.87 ETH and 31,500 DAI.
• CoinDesk saw about 2,234 ETH in the consolidation wallet on 24 September, which later sent ETH onward.
• A ChainBounty investigation found 20 Tornado Cash deposits totalling 1,370 ETH from wallets associated with the consolidation address.

Other indicators on the page: Tron recipient TAvraZZFCZbDSZoyqWWRRsBkFgZqKaCGbK, Solana recipient A3EBrhMBEGzcPgmbwywSPhW39G6PFGrorU8ib99T6yKw (5,325.764 SOL, 397,880 USDC, 44,850 TRUMP), and Bitcoin recipient bc1qhtu84kz3y94lvgl2t05zk84tqh57grvd82zvcl.

What to do

The page gives no remediation. It supports these uses:

• Add the addresses above to monitoring or blocklists.
• When rotating a compromised hot wallet, treat a new address as insufficient unless the key custody or signing path also changes. The page states that Duelbits has not said what it changed after 2024.

Caveats

• Duelbits promised an explanation within 24 hours on 24 September. As of 2 October there was no root-cause report or chain-by-chain accounting.
• The loss estimates ($4.2 million, $4.3 million, $4.9 million, $6 million, $7 million) are successive and unreconciled. Cross-chain swaps risk double-counting.
• Duelbits said it reopened with deposits and withdrawals live and about $8 million across hot and cold wallets. It also changed player deposit addresses. The page gives both 26 September and 05:04 UTC on 27 September for the reopening. The funding wallets it published do not prove reserves or what is owed to players.
• Duelbits' April 2026 blog post said no breaches had been reported since 2020, which contradicts its February 2024 disclosure. The same post claimed offline, air-gapped player funds.
• The Rekt piece is an anonymous-author analysis with editorial commentary.