Ransomware Bitcoin: A Crypto Casino Targeted by a $15 Million Ransom

Double trouble for Gamdom. In Oscar Wilde's words, Lady Bracknell believes that losing one parent is a misfortune, but losing both looks like carelessness. The crypto casino lost its hot wallets on October 13 and is now in the crosshairs of a ransomware group.

Named WhiteArmor, it claims to hold 15.4 million accounts and demands $15 million in bitcoin. Gamdom contests the extent of the leak in an industry that has not forgotten the $41 million Stake heist. Key points of this article:

• Gamdom suffered a devastating attack, losing its hot wallets on October 13, and is facing ransomware demands from the WhiteArmor group.
• WhiteArmor demands a ransom of $15 million in bitcoin, claiming to have access to 15.4 million accounts, but the extent of the leak remains disputed.

Gamdom in the sights of ransomware WhiteArmor

The announcement was made on October 26, 2026 on WhiteArmor's leak site. This is the showcase where ransomware groups expose their victims to increase pressure.

The hackers claim to hold 15,420,003 accounts spread across 146 data columns. They also estimate Gamdom's "cumulative profit value" at over a billion dollars, without ever explaining this calculation.

The demand is succinct: $15 million in BTC. Payment instructions will arrive "directly via email," the announcement archived by ransomware.live specifies. A countdown of about two weeks runs under the announcement before the data is published. WhiteArmor's announcement targeting Gamdom on its leak site, with the countdown before data publication (source: ransomware.live)

WhiteArmor claims to have entered through a machine account with administrator rights. This account was supposedly created years ago without anyone ever renewing its credentials.

As proof, the group released a sample of 100 accounts. Dark Web Informer, the X account that relayed the announcement, specifies that no one has yet verified this file.

The scheme is that of double extortion. The hackers steal the data, encrypt the systems, and then charge twice: to restore access and to avoid publication.

WhiteArmor appeared less than a week ago. Its first claims date from October 21 to 23 according to trackers, and the group already cites Whirlpool or J.B. Hunt among its victims. The site ransomware.live itself recommends treating its announcements "with caution" until they are verified.

Gamdom still reeling from the October 13 hack

The timing is sharp. On October 13 around 15:50 UTC, Gamdom's hot wallets began to drain. These are the wallets that are always connected and used to pay for players' current withdrawals.

The site cut access that evening. The next day, the platform mentioned a disk failure and an "unauthorized connection on one of [its] automation servers."

Its founder Felix Romer estimated the loss at "just over $3 million." The on-chain investigator vxdb counted $4.2 million taken out across eight networks, including $2.2 million on Ethereum-compatible chains and nearly $1 million on Solana.

Gamdom reopened on October 16 with a flurry of bonuses to bring players back. Without publishing any proof of reserves.

Nothing officially links the two cases. WhiteArmor does mention the October hack in its announcement, but the entry point it describes does not match what Gamdom reported.

Data leak at Gamdom and players on the front line

Felix Romer does not deny everything. According to crypto.news, the founder speaks of "a few hundred accounts" accessed and not the entire database. He also claims to have shut down the servers after the October 13 attack.

Between a few hundred and 15.4 million, there is a significant gap. Ransomware groups are known to inflate their trophies, especially when they are starting out and trying to make a name for themselves.

But even partial, a crypto player database is a ready-made target list for phishing. It reveals who plays, and thus who holds cryptocurrencies.

If you have a Gamdom account, change your password and enable two-factor authentication. And be wary of any email promising a refund or a compensation bonus in the name of the casino.

Gamdom is the second crypto casino hit in a month, after Duelbits, which was drained of about $7 million at the end of September. On the ransom side, bitcoin remains the default currency for hackers, to the point that some companies have been stockpiling it since 2017 "just in case."

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.