Gamdom Hot-Wallet Breach

On October 13, 2026, Gamdom, a crypto gambling platform, lost funds from its hot wallets across several blockchains after an intruder reached its infrastructure, with on-chain analysts estimating the drain at approximately $4.2 million — well above the company's own "just over $3 million" figure.

What happened

Gamdom operates custodial hot wallets to settle player deposits and withdrawals in crypto. According to the platform, staff were investigating a suspected disk failure on one server when they discovered an unauthorized connection on one of its automation servers. Whatever that access reached, it ended with Gamdom's hot-wallet system paying out to attacker-controlled addresses.

Between roughly 15:50 and 16:50 UTC on October 13, each hot wallet made a large transfer to a single receiving wallet on the same network. The outflows spanned Ethereum, Solana, BNB Chain, Tron and the XRP Ledger, with on-chain investigator vxdb also tracing movement across Polygon, Arbitrum, Optimism and Bitcoin. vxdb pegged the total at about $4.208 million: roughly $2.2 million across the EVM chains, about $965,000 on Solana, $668,000 in Bitcoin and $375,000 on Tron. On Ethereum, about $1.2 million was converted from USDT and USDC into DAI within minutes using decentralized exchanges, a typical step to shed freezable stablecoins. Gamdom's publicly tracked balances fell from about $10.5 million on October 12 to roughly $76,000 a day later. The company said it halted further outflows and took the site offline, and insisted on X that "user funds are safe."

Aftermath

Gamdom founder Felix Roemer confirmed the platform had "noticed a breach attacking our hot wallet system" and paused operations while it investigated. The company has not said what the compromised automation server did, whether player data was exposed, or exactly how the intruder obtained signing authority over the wallets. The gap between Gamdom's ~$3 million estimate and vxdb's ~$4.2 million on-chain figure remained unexplained at the time of writing; recovered or re-routed funds could account for part of it. No attacker had been identified and no funds had been publicly recovered, though Arkham Intelligence was monitoring wallets believed to belong to the attackers.

Why it matters

Gamdom is the latest crypto casino to lose custodial funds to an infrastructure compromise rather than a smart-contract bug. The pattern — a server or key breach that lets an attacker sweep hot wallets across many chains at once, then launder through DEX swaps into DAI and bridges — mirrors the Duelbits hot-wallet drain weeks earlier, where about $7 million left a gambling platform's wallets across five chains in a suspected private-key compromise. It also echoes the far larger Bitget backend breach, where attackers spoofed withdrawals from a custodial platform's infrastructure. As at Liquid Network, the lesson is that for a custodial operator the signing environment is the crown jewel: once the keys move, no on-chain contract stands between the attacker and the balance.