Crypto Casino Gamdom Faces $15M Bitcoin Ransom Demand

Crypto Casino Gamdom Hit by $15 Million Ransom Demand

Popular online crypto casino Gamdom is dealing with another major cybersecurity crisis. Less than two weeks after losing millions from its operational wallets, the gambling platform now faces a massive extortion demand.

A cyber-extortion group named Whitearmor claims to have stolen private records from over 15.4 million user accounts. To keep the stolen data off the internet, the group is demanding $15 million in Bitcoin (BTCBTC+0.38%).

The Ransom Demand: What the Attackers Claim

On October 26, 2026, Whitearmor published details of the alleged breach on its extortion site. The group asserts that it controls 146 distinct data fields for each compromised account.

To prove their claim, the extortionists shared a 437-kilobyte JSON sample file. This sample contained details for approximately 100 account records.

Additionally, Whitearmor alleged that the compromised accounts represent more than $1 billion in combined user profits. However, the group provided no evidence or explanation for how it calculated that valuation.

How Did the Breach Happen?

Reports indicate the data leak is connected to events on October 13, 2026. On that date, a hacker using the handle "Veryso" claimed to have extracted Gamdom's database during a broader system attack.

The vulnerability reportedly stemmed from an outdated internal machine account. The credentials for this system account had never been rotated, leaving high-level administrative access open long after creation.

Gambling industry outlet Gambling Lore verified one long-term user record from the sample. That verified entry included sensitive items like login timestamps, IP addresses, and personal betting records.

Gamdom Disputes the Scale of the Data Leak

Gamdom founder Felix Römer has publicly disputed the alleged size of the breach. Initially, Römer suggested that attackers had only managed to extract data for a few hundred accounts.

In subsequent statements, Gamdom acknowledged that usernames, email addresses, and gambling activity might have been exposed. However, the company emphasized that identity verification documents (KYC files) were completely unaffected.

As of now, no independent body has confirmed whether all 15.4 million accounts were truly compromised. Furthermore, there is no public indication that any ransom payment has been made.

Recap of Gamdom's Earlier $3 Million Wallet Hack

This extortion demand comes right on the heels of a separate security breach. On October 13, 2026, hackers targeted Gamdom's operational cryptocurrency wallets.

Felix Römer confirmed losses of over $3 million from that wallet attack. Blockchain researcher vxdb estimated the damage to be even higher, at roughly $4.2 million stolen across multiple blockchain networks.

Gamdom temporarily shut down platform operations before restarting on October 16, 2026. The platform assured customers that their active account balances remained fully backed and safe.

Cybersecurity Concerns and Hot Wallet Risks

A hot wallet is an internet-connected crypto wallet. While hot wallets allow online platforms to process quick transactions, their constant connectivity makes them tempting targets for hackers.

Security breaches like the one at Gamdom highlight the risks of keeping digital assets on centralized platforms. Cybersecurity experts note that automated attacks and AI-assisted exploits are becoming increasingly common across the web.

Past performance of digital assets is not a guarantee of future performance. Crypto users should always consider security risks when storing funds on third-party services.

Key Takeaways from the Security Crisis

• Whitearmor demands $15 million in Bitcoin for alleged records of 15.4 million Gamdom accounts.
• Gamdom disputes the scale of the leak and affirms that identity verification documents remain secure.
• The ransom demand follows an October 13 hot-wallet breach costing between $3 million and $4.2 million.
• Unrotated machine credentials and online wallet exposure were identified as primary vulnerability points.