Gamdom hot-wallet breach: what Gamdom, its founder and the blockchain show

Gamdom is a crypto casino in our index, and one we have tested with our own money. This report sets out, in order, what Gamdom and its founder have said about the outage that began on 13 October 2026, what the blockchain shows, and what neither has explained. Times are UTC. We read every source on 15 October 2026.

01What Gamdom said

Gamdom’s first word came on X at 18:45 UTC on 13 October, with no reason given:

“We’re currently offline, will be back up and running soon.”

Gamdom on X, 13 October 2026¹

At 22:26 UTC it said it was still working on getting the site back online.² The explanation followed at 03:36 UTC on 14 October, in a post Gamdom pinned to its profile: about 24 hours earlier it had detected a potential disk failure on one of its servers; investigating it, it found an unauthorised connection on one of its automation servers, and took all of its systems offline as a precaution. The post said: “User funds are safe.”³

02What the founder confirmed

At 16:43 UTC on 14 October, Gamdom’s founder, Felix (@Romer), went further than the company had:

“…we lost just over $3m to the breach…”

Felix (@Romer) on X, 14 October 2026⁴

He wrote that Gamdom had noticed a breach attacking its hot wallet system, took measures to stop the drain, and moved the rest of its hot-wallet funds to cold wallets; that all checks had been run; and that Gamdom was preparing to come back up, which would take a couple of hours.⁴

Our analysis The two statements fit together but do not say the same thing. Gamdom’s post described a server intrusion and said user funds were safe; the founder’s, thirteen hours later, put a figure on a loss from its hot wallets. A hot wallet is the online wallet a casino pays withdrawals from. Neither post says whose money was in it, or how player balances are now covered.

03What the blockchain shows

FairGambling, which tracks casino wallets, reported that Gamdom’s hot wallets on Ethereum, Solana, BNB Chain, Tron and the XRP Ledger sent more than $2.3 million to five wallets, at least four of them new, between about 15:50 and 16:50 UTC on 13 October — about two hours before Gamdom went offline. By its count, Gamdom’s tracked hot-wallet holdings fell from about $10.5 million on 12 October to about $76,000 on 13 October; the Tron and XRP funds moved on within 80 minutes.⁵

We read the main Ethereum receiving wallet FairGambling identifies ourselves. Etherscan shows it was funded by an address it labels “Gamdom: Hot Wallet”, at 16:10 UTC on 13 October. Between 16:00 and 18:17 UTC it took in about 87 ETH and USDT, USDC and USD1 stablecoins — from wallets Etherscan labels Gamdom and from one unlabelled address — and, from 16:23 UTC, swapped the stablecoins into DAI through CoW Protocol. When we read it, it held about 86.9 ETH and about $952,000 in one token, and had sent nothing for about 30 hours.⁶ FairGambling reports a second Ethereum wallet, and puts the two together at about $1.8 million in DAI and 87 ETH.⁵

Our analysis The swap matters. USDT and USDC can be frozen by their issuers; DAI cannot. Converting within minutes is the step of someone expecting a freeze.

04Timeline

1. 12 Oct

   Gamdom’s tracked hot wallets hold about $10.5 million, per FairGambling.⁵

2. 13 Oct, 15:50–16:50 UTC

   More than $2.3 million leaves the hot wallets on five chains.⁵

3. 13 Oct, 16:00–18:17 UTC

   The main Ethereum receiver collects ETH and stablecoins and swaps the stablecoins into DAI.⁶

4. 13 Oct, 18:45 UTC

   Gamdom: “currently offline”.¹

5. 13 Oct, 22:26 UTC

   Gamdom: still working on getting back online.²

6. 14 Oct, 03:36 UTC

   Gamdom: unauthorised connection on an automation server; systems offline; “user funds are safe”.³

7. 14 Oct, 16:43 UTC

   Founder: just over $3 million lost; the rest moved to cold wallets; reopening being prepared.⁴

8. 15 Oct

   The receiving wallet still holds its ETH and DAI; Gamdom has posted no newer update.^3,6

05What is still unclear

• How the attacker got in beyond “an unauthorised connection on one of our automation servers”.³
• Whether any player data was reached. Gamdom has not said.
• Whose money the $3 million was, and how player balances are backed now.
• Whether the site has reopened and withdrawals are processing normally.
• Whether the funds can be recovered, and whether the matter has been reported to the police.

06What it means for Gamdom’s score

Gamdom’s Trust Score stays 9.5. Our methodology is fixed: it scores withdrawal and deposit speed, reliability, fees, limits, the terms, the licence, our tester’s experience, complaint handling and independent audits, and none of those measures a security incident. We do not change the formula because of one casino’s week. What would move the score is what the incident does to payouts — a withdrawal held, delayed or refused — and that is exactly what our own test records.

Our analysis A casino that loses $3 million from a hot wallet and says players are covered is making a solvency claim. Withdrawals are how it is proved. We will add a timed withdrawal to our Gamdom test once the site is back, and report what happens.

Velven has an affiliate relationship with Gamdom: we earn a commission on sign-ups through our link. It is not an input to the Trust Score and played no part in this report.

07What players can do

1. Wait for the reopening before depositing. Gamdom has not yet said its systems are restored.
2. Withdraw what you don’t need on the site once it is back, and note how long it takes.
3. Use only Gamdom’s own channels. Breaches draw fake “refund” and “claim” pages; Gamdom’s announcements have come from @gamdom on X.^1,3
4. Change your Gamdom password and turn on two-factor authentication when you log in again.

08Questions