My account got hacked on Duel.com

[noviesol]

My password got hacked on Duel. Someone got access to my account.

Tipped away all my balance total +/- 25.000$.

I had no 2FA on my account which is dumb.

Anyway to proceed with this or just lost case?

I don't have any access to the transactions since my balance got tipped away to random burner accounts. These accounts have withdrawn the funds so only Duel.com knows where the funds went to. Duel said they can't give any information and only to local authorities if I file a complaint.

I could find them on-chain:

https://solscan.io/tx/66SQXwfG6eCRBrSdc6Pt3xmXrUcsYpwmC6YCdJjveZjZLz5A3w9NmfBzvcdx4cT4Bo5gKkaXySW1WxsyWzGc7Fg2
https://solscan.io/tx/4J4hVWquXNSTp4xxj1RdbjQNcga6tt82Dji16cE4RQjNYiauwTuwEHKcrvvFxGkcwTAfRxNf5DyLSevC4yY8ALai
https://solscan.io/tx/4iQsuNEdMnBfwP3a5T9B8Lch9EmnznmrnLPGLhhsgtvW6X4hbpftwCvenXQGbv7N93FD1EYEZbZwLytaMewJTVNu
https://solscan.io/tx/DxokSSYD1UTwudd9x9QMPTakTCngZY1qcb8ELQgqeNfHEnDXKfSNRNZX363Guf4DfAJqy9AHLN2xAZ6TG6i8Kut
https://solscan.io/tx/EDiKBoezq2FMqTLVqTGmcKWFbHFdLwur6ev6UqUkAUCrBfUJrXgbjEGjj65H7eVhFc2LSpQdJ23cnqXhWLpw8xN
https://solscan.io/tx/41anvdmT5ZqkdVw2b8VUwiU1XN1a5UPCJBkFJmodvdgr4BmF8vW1Bf4g5RuXgf2Ak2dPZdNVwgftciqRa1Dx7eib
https://solscan.io/tx/55BB72WW5TbnCsaDbj6MEDW2jtMHdxTnHYQ6q5sikuDGP4dgbXps6gcMeR2yBpFmG3BsgP1JMwmXwpuNJLr8bDy3
https://solscan.io/tx/2CKGtbMJPiBXPqRtbpBZXgEEKCLbitXXgfydLXwAkgMDZpAwt9ZpvsYrTGYTzYn6CZB73wPFZCKjJg5KbTaEvKZA
https://solscan.io/tx/43yZFnaViVHwE18sNG5VHVF5NuDhei6tzfYtD1AZ9s5KKVa58wq1p4tu7K7Pi7YN5nUdgQxTb6wy5ikpLEGR2vN8
https://solscan.io/tx/BwAhAPJdgSapTsevbELtsA2nGR4C4STChbem8m5B3SaSR6HVk3q19MBdCwkuYnjhsL1cg3ZwiVbq4iyU6whVmsZ
https://solscan.io/tx/rcS3wJtHowNmhNpMdAfzscAiPCEpXDZnANJ2gwXHdnWV5LoXsBvP6oaj3YrBrNHja2SpMYbjkQKMcaTCZSHxvSy
https://solscan.io/tx/4M1NDTJRGantbgdkmreuBjRKdbJFxyZYfJD3iZqYHNLqhNYfFEE2JSKmVJo7Gr5PD1UUJASTuS95Bw9FQB11NrNM
https://solscan.io/tx/2XmrqpQLD5tjKkHray5sbUZVx5rUMq47YYmsbrYAgSi4oyDErLKnkVNmVbwLw3JnikSVRFioK8Bb5FGePmahbKTh
https://solscan.io/tx/636Y6TWazyH7TnvpdWAzkZuc9mFpZqmwLpnrRSJCsx5xVUmd4GKWNat86xdRaX67FytjR78rPvsyx4WCHs3cYcBL
https://solscan.io/tx/2kpCd9E9LT83puTtZXY9oWQxwNfMjgAzfUsgxp2R5By1WMDvB4ysR2u78TC53wjMS6x1mhzBoZKQYXhcexRRUi2R

All the funds are were split via this account;

https://solscan.io/account/B8vQvywnHLo2Uy3ov8nJfK9Zhvz9wn4jvvHaZriuBoUC

I checked the hackers' wallets, and my suspicion is that they are splitting the stolen funds between three individuals.

There appears to be a clear pattern in how they move the funds. For example, in the transaction history below, they receive funds from the Duel.com Hot Wallet and then distribute them across three separate wallets. Two of these wallets are also among the addresses I previously identified as having received my stolen funds.

What surprises me is that none of these withdrawals appear to have been reported or flagged on Duel.com, despite the fact that this activity continued for 10 consecutive days using the same wallet address. This is just one of the many addresses that are receiving funds from the Duel Hot Wallet and afterwards sending it to the hackers wallets.

Example 1:


Example 2:


Example 3:


Example 4:


I can continue pasting more examples of funds being extracted from Duel.com and sent to their wallets but its a problem going on for 4 months+

I traced funds from one wallet. In both cases the scammer moved the funds from their wallet to an intermediate address, bridged them to BSC via the Bridgers program contract, and then deposited them into KuCoin. All transaction hashes are listed below so they can be checked on a block explorer. I am sharing this since KuCoin doesn't do anything only if the police wants them to freeze the accounts.

Trace A: Scammer wallet → Address A → Bridgers → BSC → KuCoin

Step 1: Scammer wallet to address A (Moving)

Code:

From: B8vQvywnHLo2Uy3ov8nJfK9Zhvz9wn4jvvHaZriuBoUC
To:   HSdkqYMw2M7r4as8J8idXixQfXdFBWt4Z1LXa7U2JA2N
TX:   62deRLU4nx9dqgKNtmAKWMFi96gKr2cc1ahZGzQeqgFGfegMBqaHB8VzvtoUPcYbDYn5qiYJsyVCaNY2krbJHKqD

Step 2: Address A bridges funds to BSC wallet (Moving)

Code:

From: HSdkqYMw2M7r4as8J8idXixQfXdFBWt4Z1LXa7U2JA2N
To:   Bridgers Program Contract
TX:   3rXogmgR7AeBG1pWTpomV2nwQLb6H74ZMCTBdZCeMSew7YAtzFLW5jPcGcbk9sQxQ5Dui48DtPqK2hdiCCjyCs2D

Step 3: Bridge transaction (Moving)

Code:

From: Bridgers Program Contract
To:   0x8dbB2A754467bC610b78597A7DCB0A4f122dDD73
TX:   0x7fc755a5c2c8583e6fb45f1cce320050c53a5728870b1d12ec4c86e4ad7e52b7

Step 4: Deposit into KuCoin (Transfer to KuCoin address)

Code:

From: 0x8dbB2A754467bC610b78597A7DCB0A4f122dDD73
To:   0x98fa8A5bb65262365A15B770cdEa357c2f753d1E
TX:   0xfeb5dd7c6da5a216f613559e46b542ea81c03f271fece22512a4dbe58980e924

Trace B: Scammer wallet → Address B → Bridgers → BSC → KuCoin

Step 1: Scammer wallet to address B (Moving)

Code:

From: 7gFCQHXuxjBydUghpr5YrEQCvYAFF86YmVjkGUh4WCuB
To:   35w8uMg8KCjXq7BPPNP9XLLkNShnfgtTFDeC9Qg8xS6G
TX:   39kZYLboJFcoyhqD3oWE9G6DPpMdCTfVK8epDPKoWC2TFaFi7oWBBYEfnLuk5KV1sL5S5yNpjnPVrniNG6ocKzLt

Step 2: Address B bridges funds to BSC wallet (Moving)

Code:

From: 35w8uMg8KCjXq7BPPNP9XLLkNShnfgtTFDeC9Qg8xS6G
To:   Bridgers Program Contract
TX:   67JnawYHGZvvN6c5ZxSiT8fKRqSsBqNpxKuxX7f34a3tVshuWX24n2vnhDv1trudXS1gp4Gbsi9RVFHpwTdQ8JYJ

Step 3: Bridge transaction (Moving)

Code:

From: Bridgers Program Contract
To:   0x95f34dAc4e81adC5A93F8C9154CBd29DA3efB8B4
TX:   0x95c79ffe796ea856ff8312e5d4c6da478760876f1a335e413206bf0e9c4a0ed8

Step 4: Deposit into KuCoin (Transfer to KuCoin address)

Code:

From: 0x95f34dAc4e81adC5A93F8C9154CBd29DA3efB8B4
To:   0x7B07eA640229e36a5F28EC5b4CC9576F154b11E0
TX:   0xd1585f1d517684feb95acb1d214599e5a9602e4cf1816b0ecd0d8f43e7c0e669

KuCoin deposit addresses:

Code:

Trace A: 0x98fa8A5bb65262365A15B770cdEa357c2f753d1E
Trace B: 0x7B07eA640229e36a5F28EC5b4CC9576F154b11E0

[_act_]

I was thinking this will be about Duelbits, but it is not about Duelbits.

I think you are referring to Duel.com.

I did not know the reason I am seeing this kind of reviews about the site: https://uk.trustpilot.com/review/duel.com

I do not think I can use that kind of gambling site to gamble.

But I do not think I can fault the gambling site because you supposed to use 2FA to protect your account if you are having that much amount of money on your account on the gambling site.

[Mahdirakib]

Are you talking about $25 or $25k? If it was $25k, then why would you let it go without doing anything? It is easy to access the account at Duel.com by just knowing the password since they don't send authentication email for new login. You should add some evidence here. Is there any unknown active session on your Duel account? Duel team should block the account on which the tip was sent.

You should change the password at all other casinos where you used it. Adding the 2FA would be the best thing.

[Accardo]

You have a slim chance here, because it has to do with just your account being hacked, however, all hopes are not lost, you can try going through the transaction history on the account and track the transaction hash linked to the withdrawal, to know which address the funds went to, if you're lucky, the money would be in an exchange owned address, if so, contact the exchange's support team and talk to them about this hack with all evidence shown on blockchain, supports are fully ready to respond to users regarding the recent increase in malicious activities targeting crypto users, maybe the account holding the funds would get frozen from there.

Also discuss with the Duel support team about this hack, maybe they'll find the loophole about the password leakage, could you point out how exposed your computer has been lately?

[acroman08]

Anyway to proceed with this or just lost case?

I'm assuming this is about duel.com, if not, mention the full name of the casino. Anyway, if you are thinking about the casino possibly compensating you for what happened, I don't know if they will. Because, judging by how they responded to this thread according to the OP, their support will basically say it is out of their hands.

[noviesol]

Are you talking about $25 or $25k? If it was $25k, then why would you let it go without doing anything? It is easy to access the account at Duel.com by just knowing the password since they don't send authentication email for new login. You should add some evidence here. Is there any unknown active session on your Duel account? Duel team should block the account on which the tip was sent.

You should change the password at all other casinos where you used it. Adding the 2FA would be the best thing.

I'm talking about 25.000 USD. I didn't know there were active unknown sessions.



My whole balance got tipped to random burner accounts and was also withdrawn from Duel.

You have a slim chance here, because it has to do with just your account being hacked, however, all hopes are not lost, you can try going through the transaction history on the account and track the transaction hash linked to the withdrawal, to know which address the funds went to, if you're lucky, the money would be in an exchange owned address, if so, contact the exchange's support team and talk to them about this hack with all evidence shown on blockchain, supports are fully ready to respond to users regarding the recent increase in malicious activities targeting crypto users, maybe the account holding the funds would get frozen from there.

Also discuss with the Duel support team about this hack, maybe they'll find the loophole about the password leakage, could you point out how exposed your computer has been lately?

I don't have any access to the transactions since my balance got tipped away to random burner accounts. These accounts have withdrawn the funds so only Duel.com knows where the funds went to. Duel said they can't give any information and only to local authorities if I file a complaint.

I could find them on-chain:

https://solscan.io/tx/66SQXwfG6eCRBrSdc6Pt3xmXrUcsYpwmC6YCdJjveZjZLz5A3w9NmfBzvcdx4cT4Bo5gKkaXySW1WxsyWzGc7Fg2
https://solscan.io/tx/4J4hVWquXNSTp4xxj1RdbjQNcga6tt82Dji16cE4RQjNYiauwTuwEHKcrvvFxGkcwTAfRxNf5DyLSevC4yY8ALai
https://solscan.io/tx/4iQsuNEdMnBfwP3a5T9B8Lch9EmnznmrnLPGLhhsgtvW6X4hbpftwCvenXQGbv7N93FD1EYEZbZwLytaMewJTVNu
https://solscan.io/tx/DxokSSYD1UTwudd9x9QMPTakTCngZY1qcb8ELQgqeNfHEnDXKfSNRNZX363Guf4DfAJqy9AHLN2xAZ6TG6i8Kut
https://solscan.io/tx/EDiKBoezq2FMqTLVqTGmcKWFbHFdLwur6ev6UqUkAUCrBfUJrXgbjEGjj65H7eVhFc2LSpQdJ23cnqXhWLpw8xN
https://solscan.io/tx/41anvdmT5ZqkdVw2b8VUwiU1XN1a5UPCJBkFJmodvdgr4BmF8vW1Bf4g5RuXgf2Ak2dPZdNVwgftciqRa1Dx7eib
https://solscan.io/tx/55BB72WW5TbnCsaDbj6MEDW2jtMHdxTnHYQ6q5sikuDGP4dgbXps6gcMeR2yBpFmG3BsgP1JMwmXwpuNJLr8bDy3
https://solscan.io/tx/2CKGtbMJPiBXPqRtbpBZXgEEKCLbitXXgfydLXwAkgMDZpAwt9ZpvsYrTGYTzYn6CZB73wPFZCKjJg5KbTaEvKZA
https://solscan.io/tx/43yZFnaViVHwE18sNG5VHVF5NuDhei6tzfYtD1AZ9s5KKVa58wq1p4tu7K7Pi7YN5nUdgQxTb6wy5ikpLEGR2vN8
https://solscan.io/tx/BwAhAPJdgSapTsevbELtsA2nGR4C4STChbem8m5B3SaSR6HVk3q19MBdCwkuYnjhsL1cg3ZwiVbq4iyU6whVmsZ
https://solscan.io/tx/rcS3wJtHowNmhNpMdAfzscAiPCEpXDZnANJ2gwXHdnWV5LoXsBvP6oaj3YrBrNHja2SpMYbjkQKMcaTCZSHxvSy
https://solscan.io/tx/4M1NDTJRGantbgdkmreuBjRKdbJFxyZYfJD3iZqYHNLqhNYfFEE2JSKmVJo7Gr5PD1UUJASTuS95Bw9FQB11NrNM
https://solscan.io/tx/2XmrqpQLD5tjKkHray5sbUZVx5rUMq47YYmsbrYAgSi4oyDErLKnkVNmVbwLw3JnikSVRFioK8Bb5FGePmahbKTh
https://solscan.io/tx/636Y6TWazyH7TnvpdWAzkZuc9mFpZqmwLpnrRSJCsx5xVUmd4GKWNat86xdRaX67FytjR78rPvsyx4WCHs3cYcBL
https://solscan.io/tx/2kpCd9E9LT83puTtZXY9oWQxwNfMjgAzfUsgxp2R5By1WMDvB4ysR2u78TC53wjMS6x1mhzBoZKQYXhcexRRUi2R

All the funds are currently on this account;

https://solscan.io/account/B8vQvywnHLo2Uy3ov8nJfK9Zhvz9wn4jvvHaZriuBoUC


My password probably has been leaked somewhere. I don't even remember the password I used to login. But now I changed it and setup 2FA. It was dumb not having 2FA.

Anyway to proceed with this or just lost case?

I'm assuming this is about duel.com, if not mentioned that full name of the casino. Anyway, if you are thinking about the casin possibly compensating you for what happened, I don't know if they will. Because judging by how they responded to this thread according to the OP, their support will basically say it is out of their hands.

I'm not expecting a kind of compensation. Just curious if there are any steps to take. Since filing a police report in my country is pretty useless and won't result in anything.

[Accardo]

I looked the address up, and it seems another $610 left from Rainbet to the same wallet address, then your 25k moved in, I could see the funds is leaving from this wallet you shared to this one 8i5ucY7QDvL5rXf3it6VjoxzwrsmiaLU3uwcQkevavVj, holding 137 Sol, and this other one HSdkqYMw2M7r4as8J8idXixQfXdFBWt4Z1LXa7U2JA2N, holy shit, the previous wallet containing the 25k is now emptied up, the hacker is still routing the funds to different wallet address.

keep an eye here: https://app.blocksec.com/phalcon/compliance/report/86954d07d5914846b7cdf939aa57dcc2

[AHOYBRAUSE]

damn

Jeez, how weak is the security of this site?! Are there no tipping limits or something like this. At least the receiving addresses should have some kind of history (and should be KYCd) before something like this is even remotely possible, I mean, we all know what the site will say, it's the player's fault because he was too careless with his login data, which of course is also true. Yet that doesn't explain why so much money can be tipped to some random bs accounts. I see the fault at both parties for that reason, yet I don't see any chance for the site to admit that unfortunately.

[xLays]

I was thinking this will be about Duelbits, but it is not about Duelbits.

I think you are referring to Duel.com.

I did not know the reason I am seeing this kind of reviews about the site: https://uk.trustpilot.com/review/duel.com

I do not think I can use that kind of gambling site to gamble.

But I do not think I can fault the gambling site because you supposed to use 2FA to protect your account if you are having that much amount of money on your account on the gambling site.

I don't really trust Trustpilot reviews that much. A lot of them, especially the positive ones, could be paid reviews.
Just look at duelbits trustpilot rating. It's almost the same as Duel.com's. So does that mean you wouldn't play on Duelbits either? I don't think so. You'd still play there because duelbits has a good reputation here on bitcointalk. Same goes for other gambling sites like sportsbet.io and rainbet. They have barely 1 star on Trustpilot, but they have plenty of positive feedback and a solid reputation here.

I think the point here isn't really whether you should play on duel.com or not, but how they handle account security. I believe 2FA is mandatory on duelbits unlike duel.com, which to be optional.

[Xiestar]

Are you talking about $25 or $25k? If it was $25k, then why would you let it go without doing anything? It is easy to access the account at Duel.com by just knowing the password since they don't send authentication email for new login. You should add some evidence here. Is there any unknown active session on your Duel account? Duel team should block the account on which the tip was sent.

You should change the password at all other casinos where you used it. Adding the 2FA would be the best thing.

I'm talking about 25.000 USD. I didn't know there were active unknown sessions.



My whole balance got tipped to random burner accounts and was also withdrawn from Duel.

Casino should flagged immediately a tipped behavior like that and most importantly block the withdrawal of the amount that comes from tipped since it’s not yet wagered or else it will be an easy method to launder money on that casino.

There’s nothing you can do once it’s already out of the centralized service control. You are risking a huge amount of money on centralized services without an extra layer of protection.

Not your keys not your coins! Don’t leave your balance.

[noviesol]

Are you talking about $25 or $25k? If it was $25k, then why would you let it go without doing anything? It is easy to access the account at Duel.com by just knowing the password since they don't send authentication email for new login. You should add some evidence here. Is there any unknown active session on your Duel account? Duel team should block the account on which the tip was sent.

You should change the password at all other casinos where you used it. Adding the 2FA would be the best thing.

I'm talking about 25.000 USD. I didn't know there were active unknown sessions.



My whole balance got tipped to random burner accounts and was also withdrawn from Duel.

Casino should flagged immediately a tipped behavior like that and most importantly block the withdrawal of the amount that comes from tipped since it’s not yet wagered or else it will be an easy method to launder money on that casino.

There’s nothing you can do once it’s already out of the centralized service control. You are risking a huge amount of money on centralized services without an extra layer of protection.

Not your keys not your coins! Don’t leave your balance.

That is what I thought.

My balance of 25.000 USD was tipped away in 1 sec to multiple burner accounts and instantly withdrawn. There was no safety or alert at Duel till I messaged support.

I checked the adress on-chain and associated adresses were doing this in the past as well. Burner accounts bundling funds from Duel hot wallet. Probably other accounts that got hacked.

[_act_]

I don't really trust Trustpilot reviews that much. A lot of them, especially the positive ones, could be paid reviews.
Just

Trustpilot accepted that many good positive reviews on their site are paid. Some of them like 1xbet scam site has been said to be lie. There are some that the review site may not know, but just avoid the positive reviews on the site and only be going for the negative review which have seen to be more accurate.

[The Cryptovator]

My balance of 25.000 USD was tipped away in 1 sec to multiple burner accounts and instantly withdrawn. There was no safety or alert at Duel till I messaged support.

I checked the adress on-chain and associated adresses were doing this in the past as well. Burner accounts bundling funds from Duel hot wallet. Probably other accounts that got hacked.

Sorry for your loss. But I am curious why you have been holding such a big amount on the casino sites. And how do we make sure your account is hacked or the whole platform is hacked unless the casino makes sure? On the trust pilot, they don’t have good reviews. We don’t know if Duel itself is involved with the hack or one of the developers is involved.

Since you can’t take legal action and you think it’s useless, then don’t waste your money. Just move on and try to make money. Forget about lost funds and take a lesson from that mistake. Don’t store large amounts of funds in a casino or any other centralized platform that you can’t afford to lose. From the forum's end, we can’t do much on this case, so don’t regret what happened; move on.

[RGBTC]

I checked the adress on-chain and associated adresses were doing this in the past as well. Burner accounts bundling funds from Duel hot wallet. Probably other accounts that got hacked.

If this assumption can be proven, it falls under the category of a platform hack, and you may legally be entitled to recover a portion of your losses from them.
However, since you mentioned that the hacker also sent tips to random accounts, I assume those accounts belong to the hacker and that the funds originated from the same source.

[noviesol]

My balance of 25.000 USD was tipped away in 1 sec to multiple burner accounts and instantly withdrawn. There was no safety or alert at Duel till I messaged support.

I checked the adress on-chain and associated adresses were doing this in the past as well. Burner accounts bundling funds from Duel hot wallet. Probably other accounts that got hacked.

Sorry for your loss. But I am curious why you have been holding such a big amount on the casino sites. And how do we make sure your account is hacked or the whole platform is hacked unless the casino makes sure? On the trust pilot, they don’t have good reviews. We don’t know if Duel itself is involved with the hack or one of the developers is involved.

Since you can’t take legal action and you think it’s useless, then don’t waste your money. Just move on and try to make money. Forget about lost funds and take a lesson from that mistake. Don’t store large amounts of funds in a casino or any other centralized platform that you can’t afford to lose. From the forum's end, we can’t do much on this case, so don’t regret what happened; move on.

I deposited 10.000 USD to play and won a big hand hitting 100 USD on sidebets paying about roughly 14.000 USD making my balance around 25.000 USD. After hitting that win my balance disappeared directly in seconds. This means the hacker had a active session too because it happened immediately. First, I thought it was a bug or something. After I checked my transactions and my balance was tipped away to random accounts and withdrawn. Nonetheless, I had no 2FA on my account. If i did the hacker couldn't move my funds without the code. I'm not closing out the possibility it could be a inside job but Duel won't start a investigation on this matter.

Duel didn't give me any information about it. When I asked to which accounts the funds were withdrawn they wouldn't give the information. They only say that I have to file a report with the local authorities. I managed to pull the transaction from Solscan. I did just file a report at the local police providing them with all the information I gathered and I found a link to a address that is linked to a CEX deposit adress.

I checked the adress on-chain and associated adresses were doing this in the past as well. Burner accounts bundling funds from Duel hot wallet. Probably other accounts that got hacked.

If this assumption can be proven, it falls under the category of a platform hack, and you may legally be entitled to recover a portion of your losses from them.
However, since you mentioned that the hacker also sent tips to random accounts, I assume those accounts belong to the hacker and that the funds originated from the same source.

The hacker probably targets Duel.com accounts without 2FA or where the password is stolen. I saw on-chain its not the first time the hacker managed to pull funds from Duel by withdrawing from multiple accounts.

[RGBTC]

The hacker probably targets Duel.com accounts without 2FA or where the password is stolen. I saw on-chain its not the first time the hacker managed to pull funds from Duel by withdrawing from multiple accounts.

What steps have you taken so far? Have you reached out to their support team and informed them about this anomaly?

[noviesol]

The hacker probably targets Duel.com accounts without 2FA or where the password is stolen. I saw on-chain its not the first time the hacker managed to pull funds from Duel by withdrawing from multiple accounts.

What steps have you taken so far? Have you reached out to their support team and informed them about this anomaly?

Yeah, I asked the support.

At the time when support tried to stop it was already to late. They said the funds have left Duel.com already. It frustrating that a big amount gets tipped to old dormant accounts and withdrawn to 15 fresh wallets within minutes without any checks.

They just say my password was leaked in a databreach but I find the chance small since I used a different password. Duel.com won't provide any further info and say only when local authorities reach out they will comply.

I did file a formal police report today. It doesn't cost me any money only some time but I will proceed this path for the time.

[Mahdirakib]

~snip~ I see the fault at both parties for that reason, yet I don't see any chance for the site to admit that unfortunately.

First of all, it was a mistake from the user to play with big funds without enabling the 2FA. I believe he was aware of the fact that Duel doesn't send authentication emails for new login. So, it was easy for the hacker to do all these things very easily. Similar things had also happened with several users at Stake in the past.

The casino is also responsible a bit here as they didn't block the tipping system or those accounts which received tips after this unusual activity. Casinos anti-fraud system react within a blink when users request for a withdrawal after big wins, but never in this type of situation.

I did file a formal police report today. It doesn't cost me any money only some time but I will proceed this path for the time.

I doubt you will see any progress or get an update through the police report which you have made.

[panjul07]

The hacker probably targets Duel.com accounts without 2FA or where the password is stolen. I saw on-chain its not the first time the hacker managed to pull funds from Duel by withdrawing from multiple accounts.

What steps have you taken so far? Have you reached out to their support team and informed them about this anomaly?

Yeah, I asked the support.

At the time when support tried to stop it was already to late. They said the funds have left Duel.com already. It frustrating that a big amount gets tipped to old dormant accounts and withdrawn to 15 fresh wallets within minutes without any checks.

They just say my password was leaked in a databreach but I find the chance small since I used a different password. Duel.com won't provide any further info and say only when local authorities reach out they will comply.

I did file a formal police report today. It doesn't cost me any money only some time but I will proceed this path for the time.

I cant understand the situation, unusual activity on a casino account should raise a flag in the casino security system unless you have done similar activity yourself before (tipping big amounts to others in short period of time).
It is unfortunate to see a casino if there is no flag raised in their system for the activities in your account, not only for the tipping but I'm sure the IP change usually also raise a flag in some casinos.
Of course I do not mean to blame the casino only because you also made a big mistake by not securing your account with 2FA while you know that you have big amount of money in your account.
As you have reported to police which is maybe the last effort you can do, hope it will help you to get your money back although the chance is small.

[The Cryptovator]

I deposited 10.000 USD to play and won a big hand hitting 100 USD on sidebets paying about roughly 14.000 USD making my balance around 25.000 USD. After hitting that win my balance disappeared directly in seconds. This means the hacker had a active session too because it happened immediately. First, I thought it was a bug or something. After I checked my transactions and my balance was tipped away to random accounts and withdrawn. Nonetheless, I had no 2FA on my account. If i did the hacker couldn't move my funds without the code. I'm not closing out the possibility it could be a inside job but Duel won't start a investigation on this matter.

Duel didn't give me any information about it. When I asked to which accounts the funds were withdrawn they wouldn't give the information. They only say that I have to file a report with the local authorities. I managed to pull the transaction from Solscan. I did just file a report at the local police providing them with all the information I gathered and I found a link to a address that is linked to a CEX deposit adress.

I am not getting you exactly. You are saying the accounts were tipped, and also your screenshot described the same. But you present Solana's transaction details. Wasn’t it an internal transfer between casinos? Or scammers manage to withdraw external addresses directly from your account. Or a scammer managed to withdraw internal Solana addresses to the other Duel accounts.

However, Duel could contact the exchange where the funds ended up. You have to talk with the casino about that; if they aren’t involved with that hack, then they should take it seriously and investigate deeply to help their users. When the account is hacked, it’s also their responsibility to trace where the funds ended up. I don’t think filing a police case alone would help you to recover these funds; it’s crypto and not easy to recover.