Worked example · 2026-09

Duelbits — four chains' hot wallets emptied within minutes, which is one compromise, not four — Duelbits (crypto casino) / Ethereum, BNB Chain, Tron, Bitcoin — 2026-09-24

Loss

~$7M per Duelbits' co-founder (SlowMist's tracker records $4.9M; early PeckShield alerts $4.3M as outflows were still being counted). Moved within minutes: 836 ETH, ~593,000 USDT, ~97,000 USDC, ~31,500 DAI, ~12.4B SHIB, plus 8.1 BTC from the Bitcoin hot wallet. Most was swapped to ETH and consolidated into one address holding ~2,234 ETH (~$6M), which had not moved further at last report. Duelbits states user funds are safe and took the platform offline until the investigation completes and the hot wallet is refunded.

OAK Techniques observed

OAK-T11.011 (Multi-chain Key-store Co-location — primary, inferred from the extraction pattern, following the Coinsbuy (2026-08) and Nobitex (2025-06) precedent. Near-simultaneous outflows from hot wallets on four chains with unrelated address formats and signing schemes are the diagnostic signature of one compromised signing layer serving all of them. See techniques/T11.011-multi-chain-key-store-co-location.md). The access vector is undisclosed; Duelbits said it was "still investigating exactly what happened and how." Private-key compromise is the suspected cause per ScamSniffer and press, not a confirmed finding.

Attribution

pseudonymous. Flagged first by ScamSniffer; PeckShield followed.

Key teaching point

Hot wallets on different chains are only independent if their keys are. If one intrusion can sign on Ethereum, BNB Chain, Tron and Bitcoin, the operator has one hot wallet with four balances, and its blast radius is the sum. Segregating key custody per chain — separate hosts, separate HSM partitions, separate operator access — turns a four-chain loss into a one-chain loss.