Key Takeaways
- Stolen bitcoin from the Coldcard exploit moved to Duel Casino, but the platform refused to freeze the funds.
- Duel Casino requires official law enforcement confirmation before blocking user balances.
- Galaxy Digital’s Head of Research criticized Duel’s inaction as complicit in the massive cyber theft.
Coldcard Hack Spreads: Duel Casino Refuses to Freeze Funds Without Proof
Funds allegedly linked to the Coldcard vulnerability exploit are already on the move, hitting third-party platforms as criminals seek to launder them.
Alex Thorn, Head of Firmwide Research at Galaxy Digital, alerted about the behaviour of Duel Casino, an internet gambling platform that allegedly received nearly 230 ETH from the Coldcard hack.
According to Thorn, the platform refused to freeze these funds even after receiving data linking the addresses and transactions to the event. Duel’s response asked for police to contact them, despite supposedly having access to incriminatory information.
Thorn labeled Duel’s inaction as outrageous, stressing that no police report would arrive until Monday at best.
“These shady people are refusing to freeze funds that have been forensically proven to emanate from a live cyber incident. If they do not freeze the funds, they are complicit in theft,” he declared.
A Duel team member identified as Korra on X stressed that they can’t freeze user funds only because a third party claims they are stolen, as there could be people taking advantage of this system.
Korra then offered to make an exception if the alleged victim sent a message from a “hacked” address, signed an affidavit claiming they were hacked, and showed a trail of these funds entering Duel’s wallets.
“You have to understand the reason this policy exists, we require SOME sort of official confirmation that an actual theft occurred (so confirmation from law enforcement of any kind usually), otherwise anyone can claim stuff about their own balance or a counterparty or a third party they don’t even know and get accounts frozen,” Korra stressed.
Duel Casino’s policy angered some users, who criticised the gambling platform for not issuing a temporary block on these funds while investigating the source of the funds involved in the claim.
Even so, Korra doubled down on Duel Casino’s position.
“We don’t freeze your Duel balance because someone asked us to. We simply don’t. I am sorry but that is how it is and we stand by that,” Korra concluded.
Former Delphi Digital CLO Gabriel Shapiro supported Duel Casino’s stance: “It continues to be probably my only unpopular view but I still think this is pretty much the only sane policy a crypto-adjacent fintech app can have…” he assessed.
As more wallets get drained and threat actors seek to cash out a portion of the over 1,300 BTC stolen, expect more users, companies, and institutions to face similar dilemmas.
