Gamdom hack: $2.2M still parked in DAI, $363k turned into Monero on Hyperliquid, the Bitcoin into a coinjoin

At about 16:00 UTC on 13 October, money started leaving Gamdom’s hot wallets on Ethereum, BNB Chain, Polygon, Solana, TRON and Bitcoin. Within roughly an hour more than $2.3 million was gone and the casino took its site down. The next day Gamdom said staff checking a failing disk had found an unauthorised connection on one of its automation servers; founder Felix Roemer put the loss at just over $3 million and said user funds were safe.

On-chain analyst [vxdb](https://x.com/vxdb), working from Arkham, counted $4.208 million: about $2.2 million on EVM chains, $965,000 on Solana, $375,000 on TRON and $668,000 on Bitcoin. vxdb published a map of the attacker’s wallets by their first characters, with two gaps: one 250,000 DAI branch where “the trail stops”, and $135,000 that reached an Arbitrum wallet “from an unconfirmed source”. Nothing has been reported frozen.

Three of the sending wallets were already named Gamdom in our database before the theft: 0x0067CC2416F792CF0ec5629f5506324Ac508f859, 0x580450Dff316AE00D0fbEF9621A304020A046CE2 and 0xd5FBDa4C79F38920159fE5f22DF9655FDe292d47. Between 16:00 and 17:40 UTC they sent 0x4b304741599c125a244E498D14562487d7109AB8 503,001 USDC, 426,041 USDT, 20,078 USD1 and 87.27 ETH. The attacker’s first gas came from Gamdom’s own wallet: the first transfer in was 738 DAI and 1.70 ETH from 0xd5FBDa4C79F38920159fE5f22DF9655FDe292d47.

Over the next hour and a half the dollar stablecoins were swapped to DAI through CoW Protocol, in six swaps. The BNB Chain money went the same way: 369,593 USDT and 336,943 USDT were bridged through Relay to 0xe5686AaE44d392aa6A0637FD38393859502F8667 and turned into DAI, and another 111,000 DAI arrived there through NEAR Intents from a chain the record does not show. The Solana money came over Mayan as 685,069 DAI to 0x1Cb62F47f821fa30f852DbB214e0B9e074136155.

DAI matters here. USDT and USDC have issuers that can freeze an address on request, and both have done so after thefts. DAI has no such switch. By 18:40 UTC, less than three hours after the first transfer, nothing that could be frozen was left on the attacker’s Ethereum wallets.

On 16 October 0x4b304741599c125a244E498D14562487d7109AB8 holds 952,441 DAI and 86.94 ETH, 0xe5686AaE44d392aa6A0637FD38393859502F8667 holds 869,368 DAI, and 0x1Cb62F47f821fa30f852DbB214e0B9e074136155 holds 184,054 DAI. Together that is 2,005,863 DAI and 86.94 ETH, about $2.2 million: roughly half of what was taken. None of it has moved since 14 October.

All three wallets are also being hit with address poisoning: fake DAI and USDT tokens and look-alike addresses that copy the first and last characters of the wallets the attacker used. These fake transfers show up in explorers next to the real ones and are not part of the money trail.

0x1Cb62F47f821fa30f852DbB214e0B9e074136155 sent two lots of 250,000 DAI out. The first went at 21:00 UTC on 13 October to 0xd459f435c94Def76a05615000fA41dD8111232F9, and from there to 0x80C2F05Fe22DbB70D20c71f368465858b3d68c1e. That is not a dead end: it is an ERC-4337 smart account, created from a public SimpleAccountFactory and paid for by a gas sponsor, so it never sends a transaction of its own and looks empty in a normal explorer view. Within the same minute it swapped the DAI for 249,992.87 USDC on Uniswap and burned the USDC through Circle’s CCTP bridge to 0xEcdC05d470540C9367903EE86E3587853F795d6a on Arbitrum.

The second lot went the same way seven hours later: 0xfe0Dd931f045522e05531799091d80D7F2c9E8EF, smart account 0xe130134cfa0E6E2FC878b2875473472426092105, Uniswap, CCTP, and 0x25CDF80d4141786Ce1FADFF1eCf943DCB8eFA712 on Arbitrum. Both Arbitrum wallets paid their USDC into Hyperliquid’s bridge in three equal parts within minutes of arrival. Hyperliquid received $499,977, not $250,000.

Hyperliquid accounts are public. Both accounts bought FXMR, “Freedom XMR”, a Monero token issued on Hyperliquid in July, with almost all of the USDC: 4,556.85 FXMR for $248,828 on the first account and 2,034.49 FXMR for $114,187 on the second, 6,591 FXMR, about $363,000. Each purchase was sent straight on, in dozens of small sends, to 0x51687f549b9a4607e8e6f7714a0b986c0dbcdef2.

That wallet is not the attacker’s. It received its first FXMR from the token’s deployer and its genesis holder, and through August alone took FXMR from 391 different accounts. Everything points to the issuer’s redemption wallet, the place holders send FXMR to receive Monero. If so, this part of the money is now on the Monero chain, where it cannot be followed. The FXMR issuer is the one party that knows which Monero addresses were paid.

The “unconfirmed source” on vxdb’s map is the attacker itself. At 08:10 UTC on 14 October the second account withdrew 135,500 USDC from Hyperliquid through CCTP back to 0x25CDF80d4141786Ce1FADFF1eCf943DCB8eFA712. From there 10,000 USDC went to 0xD177566f80532E26Fa2Bc2336B939B1A837F8022, and 125,499.81 USDC went through CCTP to the same address on Ethereum.

At 10:25 UTC on 14 October 0x25CDF80d4141786Ce1FADFF1eCf943DCB8eFA712 paid the 125,499.81 USDC into THORChain. Half an hour later the THORChain Bitcoin vault paid 1.49928635 BTC to bc1qpdhjfe4lyqt4y4yg46e9fxwus3y9ks537yvzmn. At 11:39 the attacker’s wallet merged it with two dust coins it already held, one of them since September, and sent 1.4995 BTC to bc1qfvan5c257qwnm9pe5kdzuxy8dgnzu2jsp7k6rz.

At 12:59 UTC that coin went into a transaction with 264 inputs and 286 outputs, six of them for exactly 1.34217728 BTC (2²⁷ satoshi). That is the shape of a Wasabi-style coinjoin, which mixes many users’ coins in one transaction so the outputs cannot be matched to inputs. The trail on Bitcoin ends there.

Gamdom’s theft looks like the Duelbits theft of 24 September: a crypto casino, hot wallets on several chains emptied in an hour, Relay used to move money between chains. We compared the two. No address, gas source or deposit address is shared, the Duelbits money went to Tornado Cash and this did not, and the exits differ. On chain data alone the two are not linked.

None of the attacker’s addresses were marked in our database. On 16 October we added them under one incident: the three wallets holding DAI and ETH, the two pass-through wallets, the two smart accounts, the Arbitrum wallet that also exists on Ethereum, and the two Bitcoin addresses. We did not mark Gamdom’s wallets, CoW Protocol, Relay, Mayan, NEAR Intents, Uniswap, Circle, Hyperliquid, THORChain, the FXMR issuer or the coinjoin. The three parked wallets are on our watch list.

If one of these addresses ever pays you, or you run a service that sees deposits from them, check it in the address check.

It does not say who the attacker is, how the server was breached, or that Gamdom, its users or any service named here did anything wrong. The loss figures by chain are Gamdom’s and vxdb’s; the Solana and TRON legs are vxdb’s and were not read by us. The full addresses, the smart-account branch, the Hyperliquid total, the FXMR purchases, the source of the $135,500, the coinjoin and the balances on 16 October are ours. That the FXMR wallet is the issuer’s redemption wallet is our reading of its history, not a statement by the issuer.