On October 26, extortion brand
WhiteArmor listed crypto casino
Gamdom on its leak site and demanded
$15M in BTC. The listing claims a full user database of
15,420,003 accounts across 146 columns, plus a ~100-account sample file. Dark Web Informer, FairGambling and ransomware.live flagged it the same day. By the next morning it was on X Trends.
That is a
claim, not a confirmed dump. Nobody independent has verified the sample or the wider database yet.
What WhiteArmor claims- Full user DB: 15.4M accounts, 146 columns, "combined profit value exceeding $1B"
- Entry via an old unrotated Metawin admin machine account (actor claim only)
- Demand: $15,000,000 in BTC, payment details by private email
- Sample file posted for "verification" — still unverified by trackers
What founder Felix Romer (@Romer) said on Oct 27- During the October attack they found no evidence of mass data extraction
- They did find injected withdrawal requests across multiple accounts and remediated those
- If the posted sample accounts are real, his working theory is a couple hundred accounts used while probing withdrawals after the hot-wallet exploit — not 15M
- The 15M figure "does not match" Gamdom's real user count
- Provably fair jab from the listing: "complete hot air"
- Even a few hundred fetched accounts is "pretty bad" for how close attackers got — just "by far not as bad as the attacker claims"
Separate from, but next to, the Oct 13 wallet breachGamdom confirmed a hot-wallet drain (~$3M per Romer; on-chain + private-key systems ~$4.2M). Site went down, came back around Oct 16, user funds reported safe. WhiteArmor cites that breach for context. Romer leans toward the same actor using leftover access to inflate a data-leak narrative. Related headlines for now, not a proven single campaign.
If you use Gamdom (or reuse that password anywhere)- Password reuse is the real risk even when a dump is unverified — change reused logins elsewhere
- Expect phishing: fake "verify / refund" DMs after a trending breach story
- Enable 2FA, rotate the password, review recent withdrawals
- Do not download "proof" JSON from a leak site — treat it as hostile
Still unknown: sample verification, whether Metawin access is confirmed, whether WhiteArmor = the wallet drainers, and any formal incident report.
Anyone got a clearer read on whether the sample looks real, or is this mostly LARP / pressure posting?
Full write-up with timeline and sources (I write for this site): LootBonus - Gamdom $15M ransom / database claim
