My account got hacked on Duel

[noviesol]

My password got hacked on Duel. Someone got access to my account.

Tipped away all my balance total +/- 25.000$.

I had no 2FA on my account which is dumb.

Anyway to proceed with this or just lost case?

[_act_]

I was thinking this will be about Duelbits, but it is not about Duelbits.

I think you are referring to Duel.com.

I did not know the reason I am seeing this kind of reviews about the site: https://uk.trustpilot.com/review/duel.com

I do not think I can use that kind of gambling site to gamble.

But I do not think I can fault the gambling site because you supposed to use 2FA to protect your account if you are having that much amount of money on your account on the gambling site.

[Mahdirakib]

Are you talking about $25 or $25k? If it was $25k, then why would you let it go without doing anything? It is easy to access the account at Duel.com by just knowing the password since they don't send authentication email for new login. You should add some evidence here. Is there any unknown active session on your Duel account? Duel team should block the account on which the tip was sent.

You should change the password at all other casinos where you used it. Adding the 2FA would be the best thing.

[Accardo]

You have a slim chance here, because it has to do with just your account being hacked, however, all hopes are not lost, you can try going through the transaction history on the account and track the transaction hash linked to the withdrawal, to know which address the funds went to, if you're lucky, the money would be in an exchange owned address, if so, contact the exchange's support team and talk to them about this hack with all evidence shown on blockchain, supports are fully ready to respond to users regarding the recent increase in malicious activities targeting crypto users, maybe the account holding the funds would get frozen from there.

Also discuss with the Duel support team about this hack, maybe they'll find the loophole about the password leakage, could you point out how exposed your computer has been lately?

[acroman08]

Anyway to proceed with this or just lost case?

I'm assuming this is about duel.com, if not, mention the full name of the casino. Anyway, if you are thinking about the casino possibly compensating you for what happened, I don't know if they will. Because, judging by how they responded to this thread according to the OP, their support will basically say it is out of their hands.

[noviesol]

Are you talking about $25 or $25k? If it was $25k, then why would you let it go without doing anything? It is easy to access the account at Duel.com by just knowing the password since they don't send authentication email for new login. You should add some evidence here. Is there any unknown active session on your Duel account? Duel team should block the account on which the tip was sent.

You should change the password at all other casinos where you used it. Adding the 2FA would be the best thing.

I'm talking about 25.000 USD. I didn't know there were active unknown sessions.



My whole balance got tipped to random burner accounts and was also withdrawn from Duel.

You have a slim chance here, because it has to do with just your account being hacked, however, all hopes are not lost, you can try going through the transaction history on the account and track the transaction hash linked to the withdrawal, to know which address the funds went to, if you're lucky, the money would be in an exchange owned address, if so, contact the exchange's support team and talk to them about this hack with all evidence shown on blockchain, supports are fully ready to respond to users regarding the recent increase in malicious activities targeting crypto users, maybe the account holding the funds would get frozen from there.

Also discuss with the Duel support team about this hack, maybe they'll find the loophole about the password leakage, could you point out how exposed your computer has been lately?

I don't have any access to the transactions since my balance got tipped away to random burner accounts. These accounts have withdrawn the funds so only Duel.com knows where the funds went to. Duel said they can't give any information and only to local authorities if I file a complaint.

I could find them on-chain:

https://solscan.io/tx/66SQXwfG6eCRBrSdc6Pt3xmXrUcsYpwmC6YCdJjveZjZLz5A3w9NmfBzvcdx4cT4Bo5gKkaXySW1WxsyWzGc7Fg2
https://solscan.io/tx/4J4hVWquXNSTp4xxj1RdbjQNcga6tt82Dji16cE4RQjNYiauwTuwEHKcrvvFxGkcwTAfRxNf5DyLSevC4yY8ALai
https://solscan.io/tx/4iQsuNEdMnBfwP3a5T9B8Lch9EmnznmrnLPGLhhsgtvW6X4hbpftwCvenXQGbv7N93FD1EYEZbZwLytaMewJTVNu
https://solscan.io/tx/DxokSSYD1UTwudd9x9QMPTakTCngZY1qcb8ELQgqeNfHEnDXKfSNRNZX363Guf4DfAJqy9AHLN2xAZ6TG6i8Kut
https://solscan.io/tx/EDiKBoezq2FMqTLVqTGmcKWFbHFdLwur6ev6UqUkAUCrBfUJrXgbjEGjj65H7eVhFc2LSpQdJ23cnqXhWLpw8xN
https://solscan.io/tx/41anvdmT5ZqkdVw2b8VUwiU1XN1a5UPCJBkFJmodvdgr4BmF8vW1Bf4g5RuXgf2Ak2dPZdNVwgftciqRa1Dx7eib
https://solscan.io/tx/55BB72WW5TbnCsaDbj6MEDW2jtMHdxTnHYQ6q5sikuDGP4dgbXps6gcMeR2yBpFmG3BsgP1JMwmXwpuNJLr8bDy3
https://solscan.io/tx/2CKGtbMJPiBXPqRtbpBZXgEEKCLbitXXgfydLXwAkgMDZpAwt9ZpvsYrTGYTzYn6CZB73wPFZCKjJg5KbTaEvKZA
https://solscan.io/tx/43yZFnaViVHwE18sNG5VHVF5NuDhei6tzfYtD1AZ9s5KKVa58wq1p4tu7K7Pi7YN5nUdgQxTb6wy5ikpLEGR2vN8
https://solscan.io/tx/BwAhAPJdgSapTsevbELtsA2nGR4C4STChbem8m5B3SaSR6HVk3q19MBdCwkuYnjhsL1cg3ZwiVbq4iyU6whVmsZ
https://solscan.io/tx/rcS3wJtHowNmhNpMdAfzscAiPCEpXDZnANJ2gwXHdnWV5LoXsBvP6oaj3YrBrNHja2SpMYbjkQKMcaTCZSHxvSy
https://solscan.io/tx/4M1NDTJRGantbgdkmreuBjRKdbJFxyZYfJD3iZqYHNLqhNYfFEE2JSKmVJo7Gr5PD1UUJASTuS95Bw9FQB11NrNM
https://solscan.io/tx/2XmrqpQLD5tjKkHray5sbUZVx5rUMq47YYmsbrYAgSi4oyDErLKnkVNmVbwLw3JnikSVRFioK8Bb5FGePmahbKTh
https://solscan.io/tx/636Y6TWazyH7TnvpdWAzkZuc9mFpZqmwLpnrRSJCsx5xVUmd4GKWNat86xdRaX67FytjR78rPvsyx4WCHs3cYcBL
https://solscan.io/tx/2kpCd9E9LT83puTtZXY9oWQxwNfMjgAzfUsgxp2R5By1WMDvB4ysR2u78TC53wjMS6x1mhzBoZKQYXhcexRRUi2R

All the funds are currently on this account;

https://solscan.io/account/B8vQvywnHLo2Uy3ov8nJfK9Zhvz9wn4jvvHaZriuBoUC


My password probably has been leaked somewhere. I don't even remember the password I used to login. But now I changed it and setup 2FA. It was dumb not having 2FA.

Anyway to proceed with this or just lost case?

I'm assuming this is about duel.com, if not mentioned that full name of the casino. Anyway, if you are thinking about the casin possibly compensating you for what happened, I don't know if they will. Because judging by how they responded to this thread according to the OP, their support will basically say it is out of their hands.

I'm not expecting a kind of compensation. Just curious if there are any steps to take. Since filing a police report in my country is pretty useless and won't result in anything.

[Accardo]

I looked the address up, and it seems another $610 left from Rainbet to the same wallet address, then your 25k moved in, I could see the funds is leaving from this wallet you shared to this one 8i5ucY7QDvL5rXf3it6VjoxzwrsmiaLU3uwcQkevavVj, holding 137 Sol, and this other one HSdkqYMw2M7r4as8J8idXixQfXdFBWt4Z1LXa7U2JA2N, holy shit, the previous wallet containing the 25k is now emptied up, the hacker is still routing the funds to different wallet address.

keep an eye here: https://app.blocksec.com/phalcon/compliance/report/86954d07d5914846b7cdf939aa57dcc2

[AHOYBRAUSE]

damn

Jeez, how weak is the security of this site?! Are there no tipping limits or something like this. At least the receiving addresses should have some kind of history (and should be KYCd) before something like this is even remotely possible, I mean, we all know what the site will say, it's the player's fault because he was too careless with his login data, which of course is also true. Yet that doesn't explain why so much money can be tipped to some random bs accounts. I see the fault at both parties for that reason, yet I don't see any chance for the site to admit that unfortunately.

[xLays]

I was thinking this will be about Duelbits, but it is not about Duelbits.

I think you are referring to Duel.com.

I did not know the reason I am seeing this kind of reviews about the site: https://uk.trustpilot.com/review/duel.com

I do not think I can use that kind of gambling site to gamble.

But I do not think I can fault the gambling site because you supposed to use 2FA to protect your account if you are having that much amount of money on your account on the gambling site.

I don't really trust Trustpilot reviews that much. A lot of them, especially the positive ones, could be paid reviews.
Just look at duelbits trustpilot rating. It's almost the same as Duel.com's. So does that mean you wouldn't play on Duelbits either? I don't think so. You'd still play there because duelbits has a good reputation here on bitcointalk. Same goes for other gambling sites like sportsbet.io and rainbet. They have barely 1 star on Trustpilot, but they have plenty of positive feedback and a solid reputation here.

I think the point here isn't really whether you should play on duel.com or not, but how they handle account security. I believe 2FA is mandatory on duelbits unlike duel.com, which to be optional.

[Xiestar]

Are you talking about $25 or $25k? If it was $25k, then why would you let it go without doing anything? It is easy to access the account at Duel.com by just knowing the password since they don't send authentication email for new login. You should add some evidence here. Is there any unknown active session on your Duel account? Duel team should block the account on which the tip was sent.

You should change the password at all other casinos where you used it. Adding the 2FA would be the best thing.

I'm talking about 25.000 USD. I didn't know there were active unknown sessions.



My whole balance got tipped to random burner accounts and was also withdrawn from Duel.

Casino should flagged immediately a tipped behavior like that and most importantly block the withdrawal of the amount that comes from tipped since it’s not yet wagered or else it will be an easy method to launder money on that casino.

There’s nothing you can do once it’s already out of the centralized service control. You are risking a huge amount of money on centralized services without an extra layer of protection.

Not your keys not your coins! Don’t leave your balance.

[noviesol]

Are you talking about $25 or $25k? If it was $25k, then why would you let it go without doing anything? It is easy to access the account at Duel.com by just knowing the password since they don't send authentication email for new login. You should add some evidence here. Is there any unknown active session on your Duel account? Duel team should block the account on which the tip was sent.

You should change the password at all other casinos where you used it. Adding the 2FA would be the best thing.

I'm talking about 25.000 USD. I didn't know there were active unknown sessions.



My whole balance got tipped to random burner accounts and was also withdrawn from Duel.

Casino should flagged immediately a tipped behavior like that and most importantly block the withdrawal of the amount that comes from tipped since it’s not yet wagered or else it will be an easy method to launder money on that casino.

There’s nothing you can do once it’s already out of the centralized service control. You are risking a huge amount of money on centralized services without an extra layer of protection.

Not your keys not your coins! Don’t leave your balance.

That is what I thought.

My balance of 25.000 USD was tipped away in 1 sec to multiple burner accounts and instantly withdrawn. There was no safety or alert at Duel till I messaged support.

I checked the adress on-chain and associated adresses were doing this in the past as well. Burner accounts bundling funds from Duel hot wallet. Probably other accounts that got hacked.