Crypto casinos promise fast deposits and fast withdrawals, and that speed is a large part of their appeal. It also creates a weak point. Behind every quick payout is a pool of funds that has to be online, reachable and ready to send. This month, the Gamdom hack showed how costly that weak point can be, and why crypto casino security has become one of the most discussed topics in the sector.
What happened at Gamdom
On 13 October 2026, more than $2.3 million left Gamdom’s hot wallets across five blockchains within about an hour. The site went offline shortly afterwards and remained down for more than two days. Gamdom relaunched on 16 October, according to one report, after a period of recovery work. Its founder, Felix Roemer, said the loss was just over $3 million. An independent on-chain estimate put the figure at around $4.2 million across eight networks, a gap that has not been fully explained.
Gamdom has said that an apparent server disk failure led investigators to find an unauthorised connection to an automation server. That automation system was the route into the hot wallets. The company said it had stopped the drain and moved remaining funds into cold storage. Blockchain trackers had earlier recorded the hot wallet balance falling sharply, from around $10.5 million on 12 October to roughly $2 million by the early hours of 14 October.
Why hot wallets are the soft spot
A hot wallet is a crypto wallet connected to the internet and used to process withdrawals quickly. Its speed is the reason casinos use it, and that same connectivity is why it is attractive to attackers. A cold wallet, by contrast, is kept offline and is far harder to reach. The practical trade-off is that casinos must keep enough in hot wallets to pay players promptly, which means keeping valuable funds exposed.
Gamdom is not an isolated case. It is the second confirmed hack at a crypto casino in recent weeks. The Duelbits hack in September 2026 drained an estimated $5.9 million to $7 million, and Duelbits had suffered a previous breach since 2024. Rollbit, which has not been hacked, saw its hot wallets fall 97% in a single week in August, from about $29.2 million to roughly $765,000, according to a wallet tracker, with staff saying the casino was moving funds to new chains.
A record year for crypto hacks
The wider crypto industry is also under pressure. TRM Labs recorded 207 crypto hacks in the first half of 2026, more than double the 85 recorded in the first half of 2025. The losses from those hacks reached $972 million, and infrastructure or operational compromises accounted for around 76% of the stolen funds. The number of incidents hit an all-time high even though the value stolen was lower than in some previous years.
That pattern matters for casinos. The most common failures are not clever cryptographic breaks. They are operational: a server that is misconfigured, an access route that is not properly monitored, or a system that can authorise transfers without enough checks. Security problems of this kind are usually preventable, which makes them harder to excuse when they happen.
The marketing gap
While security concerns grow, promotional material continues to emphasise speed and convenience. This month, press releases for several crypto casinos highlighted no-KYC play and fast withdrawals. Those claims may be accurate for the product in question, but they sit uneasily beside the security problems in the same sector. Players are being encouraged to focus on the upside, while the operational risks remain largely invisible to them.
Regulators have also been paying attention. The UK Gambling Commission has advised operators to treat crypto exchanges as high-risk channels for money laundering, and it has highlighted crash games offered on illegal crypto casinos as a particular concern. Security failures and money laundering risks are closely connected, because weak controls can be exploited in both directions.
What operators should check now
The following points are our analysis rather than conclusions from the sources, and they are not a substitute for professional security advice.
- Keep hot wallet balances as low as operations allow, and move surplus funds to cold storage on a fixed schedule rather than only after an incident.
- Separate the systems that request transfers from the systems that authorise them, and require human approval above set thresholds.
- Monitor automation servers and administrative access continuously, and treat unexpected connections as incidents until proven otherwise.
- Prepare a public incident response plan before an attack, including who speaks to players and how quickly updates are published.
- Be transparent about loss figures. A gap between the company’s estimate and on-chain analysis will be noticed, and unexplained gaps damage trust.
Trust is the real currency
Players choose crypto casinos for speed and privacy, but they stay for trust. When a platform goes offline for days and its loss figures do not match the blockchain, that trust is tested. The casinos that survive this period will be the ones that explain what happened clearly, protect player balances and show that the next attack is much harder to carry out.
If you want to follow how the sector responds, sign up for the BoiG newsletter, which covers the latest news, offers and announcements. The site’s crypto and cybersecurity sections are the place to look for further coverage of crypto gambling risks.
