On September 24, 2026, crypto casino Duelbits reported a security incident affecting operational hot wallets across multiple blockchains.

Public reporting cited in the investigation estimated the total loss at approximately $7 million, involving Ethereum, Solana, BNB Chain, Bitcoin, and Tron.

ChainBounty analyzed the Ethereum leg of the incident, beginning with a confirmed withdrawal from a Duelbits-labeled hot wallet and tracing subsequent ETH movements through newly created intermediary wallets.

The investigation identified 20 deposits totaling 1,370 ETH into the Tornado Cash Router between September 26 and September 28.

However, the full 1,370 ETH cannot be attributed to the Duelbits incident with equal confidence. Based on transaction-level value paths currently anchored on-chain, up to 1,360 ETH of the Tornado Cash deposits can be explained by the tracked incident flow.

No outbound exchange deposit was identified within the investigated path.

Executive Summary

Evidence Classification

This distinction is critical throughout the investigation.

An address interaction can establish that two entities touched the same infrastructure. It does not, by itself, establish that the investigated funds moved between them.

1. Initial Withdrawal From the Duelbits Hot Wallet

The Ethereum investigation begins with:

0x014435B1E39945CF4f5F0c3cbb5833195A95CC9B

The address was attributed to Duelbits in the attribution data used during the investigation.

Its first recorded activity occurred on February 14, 2024.

At approximately 09:02 UTC on September 24, two major transfers left the wallet only 36 seconds apart.

Full transaction hashes

The receiving wallet,

0xA77e24Fe29d16E051e487ef4Ea7b056cb05aef76

was a previously unseen EOA whose first activity occurred on September 24.

At the investigation snapshot, it retained 25.566884 ETH.

What the blockchain proves — and what it does not

Both transactions were signed by the Duelbits hot wallet itself.

That matters.

From Ethereum transaction data alone, an investigator cannot distinguish an authorized withdrawal from a withdrawal executed by someone who obtained legitimate signing authority.

The classification of these transactions as part of the reported compromise therefore relies on the incident disclosure and associated public reporting.

The Ethereum transactions themselves show ordinary signed transfers rather than direct exploitation of a smart contract.

2. The Missing Link to the Consolidation Wallet

Public reporting identified the following address as the primary ETH consolidation wallet:

0x8dB9D7f0a03d212c566Ca80c66e294CeCC20C306

The wallet first became active on September 24.

However, the investigation did not identify a direct value transfer from the initial receiver 0xA77e24... to the consolidation wallet 0x8dB9....

Instead, two common counterparties were found.

0x4293... is particularly notable because it sent funds to both the initial receiving wallet and the consolidation wallet.

That creates a meaningful investigative lead.

It does not yet create a verified value path.

The transaction amounts and transaction hashes required to demonstrate that the investigated value moved through these common counterparties were not anchored in the current evidence set.

ChainBounty therefore classifies:

This gap prevents the entire Ethereum path from being presented as one uninterrupted forensic chain.

3. A 0.1 ETH Route Test

On September 24, the consolidation wallet performed a small round-trip transfer involving another address.

Full hashes:

0x0edf6e07817a6d2eafd3f42c3d40c7dcab4756d4375286d48f26654dc9bfe52b

0x5eaf7ef13016fd76a822f046935ca7b78f76bc66095249f8a8d8fec2d79a3f1a

A 0.1 ETH round trip alone does not prove intent.

Placed alongside the substantially larger transactions that followed, however, it is consistent with route validation before larger fund movements.

That interpretation remains an analytical assessment rather than a directly provable fact.

4. First Laundering Branch: 110 ETH

Between September 26 and September 27, the consolidation wallet began distributing ETH through newly activated intermediary wallets.

The first branch started with:

0xa31bb1fdf3409ce863bf646b69e6013ca74c38e3

Consolidation Wallet → First Intermediary

Most of that ETH did not continue toward the mixer.

First Intermediary → Consolidation Wallet

Another 111.1 ETH was forwarded to:

0xadb82eef7baa2feaebe64f88577c06f803a2c578

That wallet then deposited 110 ETH into the Tornado Cash Router:

0xd90e2f925da726b50c4ed8d0fb90ad053324f31b

The remaining 1.094278 ETH was returned upstream.

This 110 ETH branch is fully explainable using the tracked transaction path.

5. Second Laundering Branch: 1,260 ETH

The second and significantly larger movement occurred on September 28.

The consolidation wallet transferred 1,252 ETH into a newly active address:

0x6495afaeb766e59f3b725e6ef6e5622b44b272c3

Consolidation Wallet → 0x6495...

That wallet subsequently transferred 1,250 ETH into:

0x56644f6a348a142d38fb7dde2e942c9ef03d09fc

The final intermediary then executed 18 Tornado Cash deposits.

Tornado Cash Deposit Structure

It also returned 1.905145 ETH upstream.

This creates an important accounting issue.

The intermediary therefore spent approximately 11.905145 ETH more than it received from the tracked upstream address.

The origin of that additional ETH falls outside the investigated outbound path.

As a result, ChainBounty does not attribute the full 1,260 ETH from this wallet to the incident.

The maximum amount supported by the tracked inflow is 1,250 ETH.

6. Why 1,370 ETH Does Not Equal 1,370 ETH of Attributed Incident Funds

The distinction can be summarized as follows.

This is one of the most important findings in the investigation.

The observed wallets deposited 1,370 ETH into Tornado Cash.

But evidence-backed attribution should stop at 1,360 ETH unless the additional funding source at 0x56644f... can also be tied to the incident.

A clean transaction graph is not the same thing as a proven provenance graph.

7. Consolidation-Wallet Flow Summary

The observed movements from the consolidation wallet can be summarized without double-counting as follows.

The wallet's complete inbound history was not reconstructed as part of this outbound tracing exercise.

The 973.536981 ETH balance should therefore not automatically be treated as entirely stolen Duelbits funds.

It is a monitored balance associated with the reported consolidation wallet, not a fully attributed recovery amount.

8. The Laundering Typology

The downstream activity shows several notable behavioral characteristics.

The pattern is more structured than simply forwarding stolen ETH directly into a mixer.

The sequence suggests an operator using temporary addresses, validating routes, scaling transaction size, and cleaning residual balances after use.

This is a behavioral assessment. It does not, by itself, identify the operator.

9. Address Poisoning Was Removed From the Graph

During transaction review, ChainBounty identified 32 transactions consistent with address-poisoning activity.

These transactions involved addresses deliberately resembling wallets in the investigation, often sharing similar starting and ending characters.

Some also transferred fake assets named similarly to ETH rather than native ETH.

Poisoning Summary

These transactions were excluded because they showed no meaningful economic value flow and matched common address-poisoning characteristics.

Including them would create false graph edges and potentially corrupt attribution.

This is an important reminder that transaction-history proximity is not equivalent to financial linkage.

10. No Exchange Cash-Out Was Identified

Within the investigated outbound Ethereum flow:

Public reporting referenced Kraken and ChangeHero in connection with activity involving the consolidation wallet.

Those references concerned claimed inbound flows into the wallet, rather than confirmed cash-out destinations in the outbound path analyzed here.

ChainBounty therefore does not identify Kraken or ChangeHero as laundering destinations based on the present evidence.

11. What the Ethereum Transactions Suggest About the Initial Compromise

The initial ETH and USDT withdrawals were ordinary signed transactions.

The available evidence is therefore more consistent with compromise of withdrawal signing authority than with a vulnerability in an Ethereum smart contract.

Possible mechanisms could include exposure of private keys or compromise of infrastructure authorized to sign withdrawals.

The blockchain cannot determine which mechanism occurred.

That question requires off-chain evidence such as key-management records, signing-service logs, server telemetry, access logs, or other internal forensic material.

12. The Most Interesting Unresolved Address

One address differs significantly from the disposable infrastructure surrounding the incident:

0x4293b5dc11b250078da7359d7d57c15eecfcf70a

There are two materially different explanations.

Current evidence cannot distinguish between them.

The wallet should therefore be treated as a high-priority lead rather than evidence of attacker ownership.

13. Remaining Investigative Opportunities

At the investigation snapshot, the two monitored wallets held:

The original 593,430.319285 USDT transfer also remains a significant unresolved asset path.

If USDT remains in token form at an identifiable downstream address, issuer-level intervention may still be relevant.

14. Fund-Flow Timeline

15. ChainBounty Assessment

The Ethereum evidence supports a clear downstream laundering pattern:

short-lived EOAs → staged routing → fixed-denomination mixer deposits → residual-balance cleanup.

It also supports a confirmed initial withdrawal of 836 ETH and 593,430.319285 USDT from a Duelbits-attributed wallet.

What the evidence does not yet support is equally important.

The value path between the first receiving wallet 0xA77e... and the reported consolidation wallet 0x8dB9... remains unanchored.

And while downstream wallets deposited 1,370 ETH into Tornado Cash, the transaction-level incident path explains up to 1,360 ETH, not necessarily the full amount.

That is the line ChainBounty draws between observation and attribution.

Conclusion

The Ethereum portion of the Duelbits incident shows a structured laundering operation built around temporary wallets and Tornado Cash.

A Duelbits-labeled hot wallet transferred 836 ETH and 593,430.319285 USDT to a newly activated address on September 24.

Separately, ETH leaving the publicly reported consolidation wallet can be followed through four short-lived intermediary EOAs into the Tornado Cash Router.

Those wallets deposited:

The distinction between 1,370 ETH observed and 1,360 ETH attributable is not a technicality.

It is the difference between describing what appeared in a wallet's transaction history and demonstrating where investigated value actually came from.

The investigation also remains incomplete at a critical point: the first recipient and the reported consolidation wallet have shared counterparties, but the value path connecting them has not yet been transaction-anchored.

For that reason, ChainBounty does not present the case as a fully closed end-to-end flow.

The next breakthroughs are more likely to come from closing that missing link, tracing the USDT path, analyzing the long-lived 0x4293... address, and monitoring the remaining ETH for interaction with identifiable services.

Because in on-chain investigations, the goal is not to draw the cleanest graph.

It is to know exactly which edges can be proven.

Investigation Metadata

This report is based on observable on-chain transaction data and address-attribution information available during the investigation. Statements describing behavior, intent, compromise mechanism, or operator infrastructure are analytical assessments unless explicitly identified as transaction-level facts.