Two weeks after its hot wallets were drained, crypto casino Gamdom is facing a second problem. On 26 October the extortion group WhiteArmor listed Gamdom on its leak site, claiming to hold the casino’s “full user database” of 15,420,003 accounts with 146 columns each, and demanded $15,000,000 in bitcoin.
Founder Felix Romer disputes the scale. He says the 15 million figure does not match how many users Gamdom actually has, and that the attackers probably hold “a couple hundred” accounts at most. A few hours later he wrote that the group “could have usernames, emails” and profit-and-loss data, “but at least not the kyc data”.
What WhiteArmor claims
According to the listing, the way in was an old internal machine account linked to MetaWin that had admin access and was never rotated. The group also says Gamdom’s users have a combined profit value of more than $1 billion and attacks the casino’s provably fair system, without evidence for either. Payment instructions are to follow by email, and a sample file is offered as proof.
Nobody has independently confirmed the full dataset. The trade site Gambling Lore reported that a person calling themselves “Veryso”, who says they extracted the data on 13 October, returned a 146-field record for one five-year-old account that matched the real account. That checks one record, not 15.4 million. WhiteArmor posted a “Verification for Gamblinglore.com” page on 27 October to show the two are in contact.
What Gamdom says
Romer says Gamdom found no evidence during the 13 October attack that user data was taken, only that withdrawal requests had been inserted into the database across several accounts, which it later reversed. He calls the provably fair allegation “complete hot air”. Gamdom has not put out a formal statement on the ransom beyond his posts.
His posts also change the loss figure. On 14 October he said Gamdom “lost just over $3m” from its hot wallets. Now he says the attackers also took around $1 million from Gamdom’s private key systems, bringing the total to about $4.2 million, and that this makes the extortion group or person “most likely the attacker”. He added that the group knows details of the stolen BTC and LTC that only someone tied to the hack would know.
Key facts
Listing: WhiteArmor leak site, 26 Oct 2026; $15M in BTC demanded.
Claimed data: 15,420,003 accounts, 146 columns each (unverified).
Founder’s view: about a couple hundred accounts at most; KYC data not affected.
13 Oct hack: just over $3M from hot wallets plus ~$1M from key systems, ~$4.2M in total (Romer, 27 Oct).
Other WhiteArmor demands: $140,000 to $5M; Gamdom’s is the largest of seven listed since 21 Oct.
Why it matters for GambleFi
WhiteArmor has been active for about a week and listed seven victims with demands, including J.B. Hunt, Whirlpool and Brazil’s Partido Liberal. Gamdom’s demand is three times the next largest. When Gamdom first reported the incident it said “user funds are safe”, and our report on the Gamdom and Duelbits hacks focused on wallet losses. A data leak is a different risk. Usernames, emails and win-loss records can be used for phishing and targeted scams, and no token or onchain record can claw that back. Gamdom has no iGaming token, but every crypto casino keeps the same kind of account database, whatever it says about provably fair games or onchain settlement. Our project risk pages, such as Rollbit, Shuffle and BC.GAME, list each platform’s reported security incidents. For the basics, see the GambleFi FAQ. This is a report on a security incident and an unverified claim, not advice on where to play.