My account got hacked on Duel.com

[noviesol]

I deposited 10.000 USD to play and won a big hand hitting 100 USD on sidebets paying about roughly 14.000 USD making my balance around 25.000 USD. After hitting that win my balance disappeared directly in seconds. This means the hacker had a active session too because it happened immediately. First, I thought it was a bug or something. After I checked my transactions and my balance was tipped away to random accounts and withdrawn. Nonetheless, I had no 2FA on my account. If i did the hacker couldn't move my funds without the code. I'm not closing out the possibility it could be a inside job but Duel won't start a investigation on this matter.

Duel didn't give me any information about it. When I asked to which accounts the funds were withdrawn they wouldn't give the information. They only say that I have to file a report with the local authorities. I managed to pull the transaction from Solscan. I did just file a report at the local police providing them with all the information I gathered and I found a link to a address that is linked to a CEX deposit adress.

I am not getting you exactly. You are saying the accounts were tipped, and also your screenshot described the same. But you present Solana's transaction details. Wasn’t it an internal transfer between casinos? Or scammers manage to withdraw external addresses directly from your account. Or a scammer managed to withdraw internal Solana addresses to the other Duel accounts.

However, Duel could contact the exchange where the funds ended up. You have to talk with the casino about that; if they aren’t involved with that hack, then they should take it seriously and investigate deeply to help their users. When the account is hacked, it’s also their responsibility to trace where the funds ended up. I don’t think filing a police case alone would help you to recover these funds; it’s crypto and not easy to recover.

My funds were tipped to different Duel Accounts (This was done automatically since my balans was tipped to 15+ accounts in 1 second). These Duel Accounts all made a withdraw resulting in 15 transaction of nearly same amount to 15 fresh Solana wallets. I managed to find them on-chain from the Duel Hot Wallet since 15 transaction resulting in nearly 25k was easy to find in all the transactions. If u look at the timing of the tip and withdraw it happend al within a minute.

I asked Duel for help but there is nothing they will do. They just tell you to file a report with the local authorities.

[The Cryptovator]

~snip~

~snip~

My funds were tipped to different Duel Accounts (This was done automatically since my balans was tipped to 15+ accounts in 1 second). These Duel Accounts all made a withdraw resulting in 15 transaction of nearly same amount to 15 fresh Solana wallets. I managed to find them on-chain from the Duel Hot Wallet since 15 transaction resulting in nearly 25k was easy to find in all the transactions. If u look at the timing of the tip and withdraw it happend al within a minute.

I asked Duel for help but there is nothing they will do. They just tell you to file a report with the local authorities.

Based on the discussion on this thread and negative feedback on their profile, it seems that themselves or one of their developers is involved with this hacking. As usual, they will not come here with an explanation since they aren’t active here. Probably they give up on forum promotion; hence, their announcement thread is also inactive.

I had been thinking of asking on their announcement thread; since it was inactive, I didn’t want to bump it. Hope if someone is still using their platform, they will notice this thread and avoid their platform. Otherwise they will lose funds this way. You may start writing on their social media as well to make more users aware, and they might draw attention to solve this issue.

[Giwagi56]

My password got hacked on Duel. Someone got access to my account.

Tipped away all my balance total +/- 25.000$.

I had no 2FA on my account which is dumb.

Anyway to proceed with this or just lost case?

Just consider the money is gone, because you didn’t do the needful for putting 2FA in your account, this is one of the reasons why i said that we are the once that allowed us to get scammed, if you have do the needful by securing your account well the person will not get access to it so fast, and from the way you talk about it and said you should forget about it, the money is not that much ? You did not differentiate the amount and it difficult to understand the kind amount you want to forget about.

From my own understanding, maybe you know the person who did that to you, that is why you want to forget about to not cause any problem or the money is not too much to be worried about, but my advice to you is to learn from this and do the right thing and avoid another problem in the future.

[Nathrixxx]

My password got hacked on Duel. Someone got access to my account.

Let's treat your case one after the order.

Have you shared your account information or login details with another user device before now, is one of the common ways some people go to their account compromised as long as the use the third party device to log in.

Tipped away all my balance total +/- 25.000$.

This figure is confusing, try to adjust the dot for a commab or the zeros to be in the right position, even though this is not even what really matter most than the fact that your money got hijacked by another person smarter than you.

I had no 2FA on my account which is dumb.

Now you see this is another fault you made, that the platform you are using provide you to initiate 2fa is a good security measures to be considered, which prevent a third party from having their way through.

Anyway to proceed with this or just lost case?

Most likely a lost case because someone already got access to your account and make the transaction, this cannot be recovered even if you traced it.

[Zwei]

It frustrating that a big amount gets tipped to old dormant accounts and withdrawn to 15 fresh wallets within minutes without any checks.

yeah, that should have definitely tripped some red flags in their security system.

They just say my password was leaked in a databreach but I find the chance small since I used a different password.

did you get any email notification about a new login to your account?
you should have get one if someone logged into your account with a new session using email/username and password. or did you not have an email added since it's optional?

Duel.com won't provide any further info and say only when local authorities reach out they will comply.

try PMing @Dollartree, see if he can give you more info.

[noviesol]

My password got hacked on Duel. Someone got access to my account.

Tipped away all my balance total +/- 25.000$.

I had no 2FA on my account which is dumb.

Anyway to proceed with this or just lost case?

Just consider the money is gone, because you didn’t do the needful for putting 2FA in your account, this is one of the reasons why i said that we are the once that allowed us to get scammed, if you have do the needful by securing your account well the person will not get access to it so fast, and from the way you talk about it and said you should forget about it, the money is not that much ? You did not differentiate the amount and it difficult to understand the kind amount you want to forget about.

From my own understanding, maybe you know the person who did that to you, that is why you want to forget about to not cause any problem or the money is not too much to be worried about, but my advice to you is to learn from this and do the right thing and avoid another problem in the future.

Indeed, the amount of money is not significant to me. But I don't like the fact of getting my money stolen by someone. Also, I know its my own fault of not setting up 2FA. However, I'm not letting this slide before I have done everything possible.

It frustrating that a big amount gets tipped to old dormant accounts and withdrawn to 15 fresh wallets within minutes without any checks.

yeah, that should have definitely tripped some red flags in their security system.

They just say my password was leaked in a databreach but I find the chance small since I used a different password.

did you get any email notification about a new login to your account?
you should have get one if someone logged into your account with a new session using email/username and password. or did you not have an email added since it's optional?

Duel.com won't provide any further info and say only when local authorities reach out they will comply.

try PMing @Dollartree, see if he can give you more info.

There are no notifications for new logins. However, Duel does list active devices and trusted devices on your account page.

I tried messaging Dollartree but the reaction is same ''We can't do much about it''.

I checked the hackers' wallets, and my suspicion is that they are splitting the stolen funds between three individuals.

There appears to be a clear pattern in how they move the funds. For example, in the transaction history below, they receive funds from the Duel.com Hot Wallet and then distribute them across three separate wallets. Two of these wallets are also among the addresses I previously identified as having received my stolen funds.

What surprises me is that none of these withdrawals appear to have been reported or flagged on Duel.com, despite the fact that this activity continued for 10 consecutive days using the same wallet address. This is just one of the many addresses that are receiving funds from the Duel Hot Wallet and afterwards sending it to the hackers wallets.

Example 1:


Example 2:


Example 3:


Example 4:


I can continue pasting more examples of funds being extracted from Duel.com and sent to their wallets but its a problem going on for 4 months+

[Shishir99]

All I can think of is this meme.
When the account owner tries to log in, it's like Who the hell are you?
But when a hacker does, it gives them access easily.

I am saying this because most platforms send emails when they detect a login from a new device and IP address. Why not Duel?

[noviesol]

All I can think of is this meme.
When the account owner tries to log in, it's like Who the hell are you?
But when a hacker does, it gives them access easily.

I am saying this because most platforms send emails when they detect a login from a new device and IP address. Why not Duel?

The hackers are targetting Rainbet and Duel.com probably because they have no mandatory security measures for withdrawals or login.

[noviesol]

I traced funds from one wallet. In both cases the scammer moved the funds from their wallet to an intermediate address, bridged them to BSC via the Bridgers program contract, and then deposited them into KuCoin. All transaction hashes are listed below so they can be checked on a block explorer. I am sharing this since KuCoin doesn't do anything only if the police wants them to freeze the accounts.

Trace A: Scammer wallet → Address A → Bridgers → BSC → KuCoin

Step 1: Scammer wallet to address A (Moving)

Code:

From: B8vQvywnHLo2Uy3ov8nJfK9Zhvz9wn4jvvHaZriuBoUC
To:   HSdkqYMw2M7r4as8J8idXixQfXdFBWt4Z1LXa7U2JA2N
TX:   62deRLU4nx9dqgKNtmAKWMFi96gKr2cc1ahZGzQeqgFGfegMBqaHB8VzvtoUPcYbDYn5qiYJsyVCaNY2krbJHKqD

Step 2: Address A bridges funds to BSC wallet (Moving)

Code:

From: HSdkqYMw2M7r4as8J8idXixQfXdFBWt4Z1LXa7U2JA2N
To:   Bridgers Program Contract
TX:   3rXogmgR7AeBG1pWTpomV2nwQLb6H74ZMCTBdZCeMSew7YAtzFLW5jPcGcbk9sQxQ5Dui48DtPqK2hdiCCjyCs2D

Step 3: Bridge transaction (Moving)

Code:

From: Bridgers Program Contract
To:   0x8dbB2A754467bC610b78597A7DCB0A4f122dDD73
TX:   0x7fc755a5c2c8583e6fb45f1cce320050c53a5728870b1d12ec4c86e4ad7e52b7

Step 4: Deposit into KuCoin (Transfer to KuCoin address)

Code:

From: 0x8dbB2A754467bC610b78597A7DCB0A4f122dDD73
To:   0x98fa8A5bb65262365A15B770cdEa357c2f753d1E
TX:   0xfeb5dd7c6da5a216f613559e46b542ea81c03f271fece22512a4dbe58980e924

Trace B: Scammer wallet → Address B → Bridgers → BSC → KuCoin

Step 1: Scammer wallet to address B (Moving)

Code:

From: 7gFCQHXuxjBydUghpr5YrEQCvYAFF86YmVjkGUh4WCuB
To:   35w8uMg8KCjXq7BPPNP9XLLkNShnfgtTFDeC9Qg8xS6G
TX:   39kZYLboJFcoyhqD3oWE9G6DPpMdCTfVK8epDPKoWC2TFaFi7oWBBYEfnLuk5KV1sL5S5yNpjnPVrniNG6ocKzLt

Step 2: Address B bridges funds to BSC wallet (Moving)

Code:

From: 35w8uMg8KCjXq7BPPNP9XLLkNShnfgtTFDeC9Qg8xS6G
To:   Bridgers Program Contract
TX:   67JnawYHGZvvN6c5ZxSiT8fKRqSsBqNpxKuxX7f34a3tVshuWX24n2vnhDv1trudXS1gp4Gbsi9RVFHpwTdQ8JYJ

Step 3: Bridge transaction (Moving)

Code:

From: Bridgers Program Contract
To:   0x95f34dAc4e81adC5A93F8C9154CBd29DA3efB8B4
TX:   0x95c79ffe796ea856ff8312e5d4c6da478760876f1a335e413206bf0e9c4a0ed8

Step 4: Deposit into KuCoin (Transfer to KuCoin address)

Code:

From: 0x95f34dAc4e81adC5A93F8C9154CBd29DA3efB8B4
To:   0x7B07eA640229e36a5F28EC5b4CC9576F154b11E0
TX:   0xd1585f1d517684feb95acb1d214599e5a9602e4cf1816b0ecd0d8f43e7c0e669

KuCoin deposit addresses:

Code:

Trace A: 0x98fa8A5bb65262365A15B770cdEa357c2f753d1E
Trace B: 0x7B07eA640229e36a5F28EC5b4CC9576F154b11E0

[boyptc]

I am sharing this since KuCoin doesn't do anything only if the police wants them to freeze the accounts.

Yeah, they'll only take actions if there are reports filed with seal to the police and it's sent to them. And no idea how long it will take.

It's too slow if that's what they're asking through their Law Enforcement Request --> https://www.kucoin.com/legal/requests

They should give an attention when someone reports specific illicit transactions and inflows through them.

Please reach out to us promptly within the freeze period and provide us with the email address used by the institution to submit their request for our records if a law enforcement agency issues an official freeze document. Additionally, please note that if we do not receive a duly signed or sealed official document, freezing order, or your response by the end of the freeze period, the relevant suspicious account will be unfrozen.

Indeed, the amount of money is not significant to me. But I don't like the fact of getting my money stolen by someone.

Man, I don't know how you're able to withstand saying this but I hope you're okay because if that's me, that's more than my life savings.

[Zwei]

There are no notifications for new logins. However, Duel does list active devices and trusted devices on your account page.

did the hacker device show there?

i'm wondering if maybe your password didn't get hacked and maybe your browser session got hijacked, or something like that.
or who knows, there might be an unpatched exploit on their website that the hacker is using.

I tried messaging Dollartree but the reaction is same ''We can't do much about it''.

that's disappointing, considering you are out $25k.

honestly, duel.com needs to up their users security, at least make 2FA mandatory for withdrawals and tips. it might add a bit of annoyance to users experience, but that's better than having your players lose money if their account gets compromised.

I checked the hackers' wallets, and my suspicion is that they are splitting the stolen funds between three individuals.

There appears to be a clear pattern in how they move the funds. For example, in the transaction history below, they receive funds from the Duel.com Hot Wallet and then distribute them across three separate wallets. Two of these wallets are also among the addresses I previously identified as having received my stolen funds.

...

I can continue pasting more examples of funds being extracted from Duel.com and sent to their wallets but its a problem going on for 4 months+

you know, if you could track those stolen funds, i'm sure duel.com would have been able to do that too. and if this has really been going on for 4 months now, i don't think they care to try and stop this.

[Shishir99]

I traced funds from one wallet. In both cases the scammer moved the funds from their wallet to an intermediate address, bridged them to BSC via the Bridgers program contract, and then deposited them into KuCoin. All transaction hashes are listed below so they can be checked on a block explorer. I am sharing this since KuCoin doesn't do anything only if the police wants them to freeze the accounts.

The amount is not that low.
You should file a complaint and then send it to KuCoin and see if they ignore you. They should freeze the account and return the funds to the owner. Duel.com should be able to help you with this as well. I assume KuCoin would send the funds back to the Duel.com wallet where initially the funds were released. I don't know much, but I think it's worth taking the hassle and filing a complaint, which might help you get your funds back.