Duelbits hack: five chains drained into one wallet, and 1,370 ETH now in Tornado Cash
PublicAML · On-chain investigation · 29 September 2026
On 24 September 2026 the hot wallets of the crypto casino Duelbits were emptied on Ethereum, BNB Chain, TRON, Solana and Bitcoin within minutes of each other, which points to stolen private keys rather than a contract bug. Duelbits’ co-founder put the loss at about $7 million. We followed the Ethereum, TRON and Solana legs: almost everything was converted to ETH and brought to one wallet, 0x8dB9D7f0…C306, which held 2,333.6 ETH. On 26–28 September the attacker started emptying it: 1,370 ETH went into Tornado Cash through four fresh wallets. 973.5 ETH is still there.
2,333.6 ETH
consolidated into one attacker wallet by 25 Sep (≈ $6.2M)
1,370 ETH
deposited into Tornado Cash on 26–28 Sep
973.5 ETH
still on the consolidation wallet on 29 Sep
5 chains
drained at once: Ethereum, BNB Chain, TRON, Solana, Bitcoin
How Duelbits was hit
The first outflow left the casino’s TRON hot wallet at about 08:58 UTC on 24 September; the Solana hot wallet was empty by 09:00, the Ethereum one by 09:02. Nothing in these transactions calls a contract in an unusual way: they are plain transfers signed by the wallets themselves. Whoever sent them held the signing keys for every chain at once, which is why analysts describe it as a private-key compromise. Duelbits has not published a root cause, and this page does not guess one.
Early estimates of $4.2–4.3 million (ScamSniffer, PeckShield) covered the first three chains only; ScamSniffer later added 209 BNB on BNB Chain and 8.1 BTC on Bitcoin, and Duelbits’ co-founder spoke of about $7 million. The ~$6.2 million in ETH we trace below, plus the Bitcoin, fits the co-founder’s figure.
Everything became ETH
On Ethereum the hot wallet 0x014435B1E39945CF4f5F0c3cbb5833195A95CC9B (labelled “Duelbits” on Etherscan) sent 836 ETH, 593,430 USDT, 96,805 USDC, 31,515 DAI and 12.4 billion SHIB to 0xA77e24Fe29d16E051e487ef4Ea7b056cb05aef76, the address ScamSniffer tagged “Hacker (EVM)”. The tokens were swapped for ETH within hours: stablecoins can be frozen by their issuers, ETH cannot.
On TRON the hot wallet THqFmhAPcdHECH3wmrpZv4MWAB2v9TY1oN sent 476,058 USDT to TAvraZZFCZbDSZoyqWWRRsBkFgZqKaCGbK. It was sold for about 1.39 million TRX and bridged to the same Ethereum wallet through Relay in 16 lots of roughly 100,000 TRX.
On Solana the hot wallet FoxqdkGRDZstVFA3wAyLnhua5ZB7jpoE36L3kcUAMqf4 lost 5,294 SOL to A3EBrhMBEGzcPgmbwywSPhW39G6PFGrorU8ib99T6yKw. About 3,529 SOL of it crossed to Ethereum through Relay and arrived as ETH at 0xb5909F3539FE2733866BbdE2d3FfCA5c6292eBBF, then passed 0x2A8D93C0096db4F68AFd8e007dee9cdCD4180E62 and 0x922ADc930Ceeaeda74AD9cA86474a753f7D8cD23.
The Relay bridge’s public request log is what ties the three chains together: each bridge request records the sender on the source chain and the recipient on Ethereum.
One wallet by the next morning
By 13:08 UTC on 24 September the three streams met on 0x8dB9D7f0a03d212c566Ca80c66e294CeCC20C306: 1,601.17 ETH from the relay wallet 0x181A638038A4bD75c207d080DE83e217f8e8a1d7, 476.53 ETH from the Solana side and 155 ETH from 0x6761c9b15815f4051773EDe39B42B95bdDB3EF1c, which sent another 99.04 ETH on 25 September. The wallet held 2,333.6 ETH, about $6.2 million, and for two days sent nothing.
| When (UTC, 2026) | From | To | Amount | Tx |
|---|---|---|---|---|
| 24 Sep 09:02 | 0x014435…95CC9B | 0xA77e24…5aef76 | 593,430 USDT out of Duelbits | 0x4f2bc2…9bb739 |
| 24 Sep 09:02 | 0x014435…95CC9B | 0xA77e24…5aef76 | 836 ETH out of Duelbits | 0xcdc0b6…23182d |
| 24 Sep 12:12 | 0xA77e24…5aef76 | 0x181A63…e8a1d7 | 1,577.88 ETH to the relay wallet | 0x4fa5a3…2b0496 |
| 24 Sep 12:42 | 0x922ADc…D8cD23 | 0x8dB9D7…20C306 | 476.53 ETH bridged SOL, as ETH | 0x5eaf7e…9a3f1a |
| 24 Sep 12:44–12:55 | 0x181A63…e8a1d7 | 0x8dB9D7…20C306 | 1,601.17 ETH into the consolidation wallet | 0x1ed02f…aca3ba |
| 24 Sep 13:08 | 0x6761c9…B3EF1c | 0x8dB9D7…20C306 | 155 ETH into the consolidation wallet | 0x91a231…b5ed28 |
| 25 Sep 11:07 | 0x6761c9…B3EF1c | 0x8dB9D7…20C306 | 99.04 ETH into the consolidation wallet | 0x614403…64487b |
| 26 Sep 09:19 | 0x8dB9D7…20C306 | 0xa31BB1…4c38e3 | 650 ETH out to a fresh wallet | 0xd91864…62d801 |
| 26 Sep 11:03 | 0xa31BB1…4c38e3 | 0x8dB9D7…20C306 | 480 ETH returned to the consolidation wallet | 0x391989…2703c1 |
| 27 Sep 01:21 | 0xa31BB1…4c38e3 | 0xAdb82e…A2C578 | 101 ETH to the Tornado feeder | 0xaa3ff3…975ff6 |
| 27 Sep 01:22 | 0xAdb82e…A2C578 | 0xd90e2f…24F31b | 100 ETH into Tornado Cash | 0xccaf6b…345349 |
| 28 Sep 08:03 | 0x8dB9D7…20C306 | 0x6495AF…B272c3 | 650 + 601 ETH out to a fresh wallet | 0x72c887…3b265e |
| 28 Sep 08:20 | 0x6495AF…B272c3 | 0x56644f…3D09Fc | 500 + 500 + 260.96 ETH to the Tornado feeder | 0xe8384b…8cff6f |
| 28 Sep 08:21–08:39 | 0x56644f…3D09Fc | 0xd90e2f…24F31b | 1,260 ETH (18 deposits) into Tornado Cash | 0x6abe85…06ddda |
Update, 26–28 September: into Tornado Cash
On 26 September the consolidation wallet sent 662 ETH to a fresh address, 0xa31BB1FDF3409CE863bF646B69E6013ca74c38e3, which passed 111.1 ETH to 0xAdb82eef7baa2fEaEbE64f88577C06F803A2C578 and returned 552 ETH to the consolidation wallet. From there 110 ETH went into Tornado Cash on 26 and 27 September.
On 28 September, between 08:01 and 08:05 UTC, the consolidation wallet sent 1,252 ETH to another fresh address, 0x6495AFaeb766E59F3B725e6eF6E5622b44B272c3. Within 30 minutes it moved on to 0x56644f6A348A142d38Fb7Dde2e942c9ef03D09Fc, and from there into Tornado Cash in 18 deposits: twelve of 100 ETH and six of 10 ETH, 1,260 ETH.
In total 1,370 ETH has entered Tornado Cash. 973.5 ETH is still on 0x8dB9D7f0a03d212c566Ca80c66e294CeCC20C306. The pattern (a small test transfer, a fresh wallet, then fixed Tornado denominations) repeated both times, so the rest is likely to follow the same route.
The wallets are being targeted in turn. Dozens of look-alike addresses that share the first and last characters of the attacker’s wallets send them zero-value transfers and fake tokens named “ETH”. That is address poisoning, aimed at whoever copies an address from the history next. None of it is counted here.
What this page does not say
It names nobody. Duelbits was also hit in February 2024; that attacker, 0x3933924faf011ae8d24e44bee450b3d78e46a666, consolidated 1,760 ETH and sent it all to Tornado Cash on 29 May 2024. We found no 2026 attacker address within two hops of that trail, which neither confirms nor rules out the same actor. The wallet that paid gas for the relay was funded from a one-off address with no history.
The 209 BNB on BNB Chain and the 8.1 BTC on Bitcoin are not traced here.
Every attacker address on this page is labelled in the PublicAML risk graph, so any service screening against it will see them. The consolidation wallet is watched every ten minutes and this page will be updated when it moves again.
Sources: Ethereum (Blockscout), TRON (TronGrid), Solana (public RPC) and Relay bridge data, read on 25 September 2026 and re-read on 29 September 2026; ScamSniffer, PeckShield, CoinDesk, Gate and Mpost for the early figures and the BNB Chain and Bitcoin amounts. Dollar values at the 25 September ETH price. This is an information resource about transactions between addresses, not financial or legal advice, and it names no individual as responsible for anything.