A hacker is demanding $15 million in Bitcoin from crypto casino Gamdom, claiming to hold more than 15 million user records. Gamdom founder Felix Römer says the attacker likely has a few hundred accounts at most, and that the ransom is an attempt to squeeze more money out of a breach that has already cost the operator about $4.2 million.
The two sides agree on little beyond this: someone got inside Gamdom’s systems around October 13, drained its hot wallets, and now holds at least some real customer data. The group publishing the demand, calling itself WhiteArmor, has set a November 9 deadline to release the data.
What the Hackers Claim
Two parties are behind the demand. A hacker using the handle “Veryso” says they pulled roughly 15.4 million rows from Gamdom’s database on October 13, with records stretching back to the casino’s first account in October 2016. WhiteArmor, the group hosting the public ransom page, says it is handling the extortion side only and does not hold the full dataset itself.
WhiteArmor’s listing puts the haul at 15,420,003 accounts with 146 fields each, and links to a sample of 100 accounts. The fields reportedly span usernames, account IDs, sign-up and login timestamps, last IP address and country, balances, deposit and wager totals, bonus and affiliate figures, Steam IDs and trade links, linked Telegram, Discord, Twitch, X, Google and Facebook IDs, email, phone, name, password hashes, two-factor secrets, KYC level, ban flags and internal admin notes.
Veryso says they first approached Gamdom privately on October 22 through Telegram accounts belonging to senior staff, found in the database itself, and received no reply. Both parties say they remain open to negotiation. WhiteArmor’s founder has described the group’s motive as purely financial.
Veryso also claims the access came through a wider shared infrastructure that included MetaWin, another crypto casino, via a common vendor they declined to name. They say Gamdom’s post-attack cleanup has since locked them out.
What Gamdom Says
Römer, responding on X early Tuesday, said Gamdom found no evidence during the attack that its database had been exported. What its team did find, he said, were withdrawal requests inserted directly into the database to trigger payouts across multiple accounts, which were reversed after the breach.
His working theory is that the attacker touched a couple hundred accounts while probing where funds could be pulled from, and that any sample records come from that set. He said Gamdom shut its servers down after the attack specifically to protect user data, and that the 15 million figure does not match the number of users the site actually has.
On the money, Römer gave a higher total than previously reported. The hot wallet drain was about $3 million, he said, but the attacker also took around $1 million from Gamdom’s private key systems, bringing the loss to roughly $4.2 million. He added that the hacker’s detailed knowledge of the stolen Bitcoin and Litecoin suggests the same person or group is behind both the theft and the ransom.
Later in the morning he narrowed his position slightly, saying it looked like the attackers could have usernames, emails and profit-and-loss figures, but not KYC identity documents. He promised a further update.
During the attack, we didn’t find any evidence to suggest that this data has been extracted from our services, only that withdrawal requests had been added to the database to initiate withdrawals across multiple accounts that we subsequently remediated after the attack.
We will check if those sample accounts are indeed real but if they are we suspect they are a sample out of a couple hundred of accounts, that were used as sample to see where they could withdraw the funds from the $3m exploit there, after the attack we shut down our server in order for user data to stay safe.
Regarding the other points
– the drain of the wallets itself was $3mln but they also took money from our private key systems of around a million which would make it around $4.2mln which indicates that this group or person is most likely the attacker
– The provably fair mention is complete hot air, I would happily chat about that
– The 15mln number is off based on how many users we actually haveOur current guess is that they have a couple hundred of accounts and that is if the data is actually real & they try to use these as leverage in order to act like they have a smoking gun in the hopes for them to extract more money out of us.
Will give an update shortly but if indeed those sample accounts got fetched that is still pretty bad in terms of how close they got but it’s by far not as bad as the attacker claims it to be.
— Felix (@Romer) October 27, 2026
Reaction
The story broke on X in the early hours of Tuesday and swung hard within three hours. Mr.Rich, a former casino CMO, first amplified the ransom claim, then declared the whole thing fake before Gamdom had said a word. By the time Römer replied, a good share of the crowd had already settled on “LARP”, with several accounts treating the owner’s cautious statement as confirmation that nothing happened.
That reading overshoots. Römer did not say the data was fake. He said the full 15 million figure was wrong and that his team found no evidence of a bulk export, while conceding that genuine account records being in the attacker’s hands would be “pretty bad” for how close they got.
Among actual users, the mood was less about the ransom and more about money. One player reported a $1,000 deposit vanishing minutes before the October 13 shutdown. Another claimed $1,600 was taken and never returned. A German-language reply threatened consequences if personal data turned out to be leaked. Römer himself noted the irony that the breach followed his own public complaint about Revolut leaking his data.
