Skip to content
Latest alertgo-ethereum v1.17.8 security release fixes p2p DoS issues and a STUN-response node crash
0xCERT
All advisories
High0xCERT-2026-0148·

Duelbits key compromise — $7.0M lost on Ethereum, BNB Chain, Bitcoin, Tron

Duelbits lost an estimated $7.0M on Ethereum, BNB Chain, Bitcoin, Tron (hot wallet key compromised), according to the DeFiLlama hacks database. Users and integrators should review exposure and follow the project's official channels.

Vuln-watch · relayed from the DeFiLlama hacks database; see Source & attribution below

Affected chainsEthereumBNB ChainBitcoinOther / Multi-chain

Summary

Duelbits lost an estimated $7.0M on Ethereum, BNB Chain, Bitcoin, Tron (hot wallet key compromised), according to the DeFiLlama hacks database. Users and integrators should review exposure and follow the project's official channels.

Incident

  • Protocol: Duelbits
  • Date (UTC): 2026-09-24
  • Estimated loss: $7.0M
  • Chain(s): Ethereum, BNB Chain, Bitcoin, Tron
  • Technique: Hot Wallet Key Compromised
  • Classification: Key Compromise
  • Target: Gambling Platform

Recommended actions

  • Revoke token approvals granted to Duelbits contracts until the project confirms they are safe
  • Integrators: pause or delist affected assets and monitor for attacker fund movements
  • Beware of follow-on phishing: ignore unofficial "refund", "recovery", or "claim" links and DMs; use the project's verified channels only

Source & attribution

This 0xCERT advisory relays an incident recorded in the DeFiLlama hacks database (https://defillama.com/hacks). Figures are preliminary estimates and may be revised; refer to the project's own post-mortem for the authoritative record. Report additional details to 0xCERT at https://www.0xcert.com/report.

Indicators of compromise

All IOC feeds →
  • address0xa77e24fe29d16e051e487ef4ea7b056cb05aef76
  • addressTAvraZZFCZbDSZoyqWWRRsBkFgZqKaCGbK

OpenPGP-signed. The signed text of this advisory verifies against the 0xCERT key CCC7 D9EC 9415 723D.

Published 2026-09-24 · last updated 2026-10-08

curl -s https://www.0xcert.com/pgp.asc | gpg --import && curl -s https://www.0xcert.com/advisory/0xCERT-2026-0148/signed.txt | gpg --verify