TL;DR:
- The Whitearmor cyber-extortion group demands $15 million in Bitcoin after claiming the theft of 15,420,003 Gamdom accounts.
- The demand was made public on October 26, twelve days after the draining of more than $3 million from the firm’s hot wallets on October 13.
- Gamdom leadership disputes the magnitude of the compromised database, while the complete leak remains without independent verification.
Crypto casino Gamdom is facing a $15 million Bitcoin ransom demand following claims by the extortion group Whitearmor that it breached the platform’s infrastructure and obtained records belonging to over 15.4 million users.
‼️🇨🇷 WhiteArmor claims access to Gamdom’s full user database and is demanding $15 million in Bitcoin.
🇨🇷 Gamdom – An online casino and sportsbook founded in 2016, offering crypto-based casino games, sports betting, and esports wagering.
The listing claims 15,420,003 user… pic.twitter.com/cFdoLxqZfq
— Dark Web Informer (@DarkWebInformer) October 26, 2026
The ransom was made public on Monday, October 26, less than two weeks after the company suffered an exploit on its hot wallets on October 13.
According to market reports, the cybercriminal organization Whitearmor claims to possess a database containing 15,420,003 customer accounts and is requesting the ransom payment in cryptocurrency to prevent the disclosure of the records. Management at the gambling firm disputes the volume reported by the attackers, maintaining an ongoing technical discrepancy regarding the scope of the incident.
The hackers published details of the stolen material on their extortion portal, claiming the dataset contains 146 information fields per account. To back their claim, the group uploaded a JSON sample file of approximately 437 kilobytes containing around 100 user records.
According to reporting by the outlet Gambling Lore, the breach allegedly originated through the exploitation of an old internal machine account whose credentials had never been rotated, retaining administrative privileges that remained active since its initial setup.
Wallet Breach and Dispute Over the Scope of the Accounts
An individual operating under the alias Veryso stated that they carried out the data extraction on October 13, a date that coincided chronologically with the intrusion into the platform’s operational wallets. The outlet Gambling Lore indicated that it independently verified an old user record from the sample, confirming login timestamps, an IP address, and betting activity. However, this isolated review does not constitute technical confirmation that the entirety of the 15.4 million accounts is in the group’s possession.
The security incident adds to the material losses recorded earlier in the month. On October 13, the platform experienced the draining of its on-chain operational funds. At the time, company founder Felix Römer acknowledged losses exceeding $3 million, while estimates by on-chain investigator vxdb placed the stolen figure around $4.2 million across multiple blockchain networks.
Following that event, the site temporarily halted operations before resuming on October 16, when it issued statements assuring that customer balances remained safely secured in cold storage vaults.
Platform leadership has maintained conflicting positions regarding the data breach. In initial remarks, Römer dismissed a massive leak, stating that the perpetrators only held access to a few hundred records. Subsequently, the company acknowledged the potential exposure of usernames, email addresses, and gaming activity records, while asserting that Know Your Customer (KYC) identity documentation was neither altered nor extracted from its central servers.
The amount demanded in Bitcoin by the extortion group is nearly five times higher than the total stolen during the operational wallet attack. The criminal organization also asserted that the set of compromised accounts represents over $1 billion in cumulative wager volume, a claim presented without an auditable calculation methodology.
To date, no independent cybersecurity entity has validated the integrity of the full 15.4 million-record archive, and casino management has not publicly confirmed any fund transfers related to the ransom demand. The case remains open while the company finishes the external forensic audits promised following the reopening of its services.
