Crypto casino Gamdom faces a USD 15 million Bitcoin ransom demand after cyber extortion group WhiteArmor claimed access to 15,420,003 user accounts. The group says it copied the platform’s entire database and released a 100-record sample. Gamdom founder Felix Romer disputes that account, saying attackers reached only a few hundred users.
Cybersecurity monitoring account Dark Web Informer reported the claim on October 26. WhiteArmor says the alleged database contains 146 columns of information, although the group has not disclosed every field. The group has not offered independent proof of its full claim.
The demand comes less than two weeks after a separate October 13 attack on Gamdom’s cryptocurrency hot wallet. That incident reportedly caused losses between USD 3 million and USD 4.2 million.
WhiteArmor Claims Old Admin Access Exposed Gamdom Data
In its October 26 leak-site message, WhiteArmor described an internal machine account that allegedly kept administrator privileges for years. The group says it used the account to enter Gamdom’s restricted systems.
WhiteArmor identified the account as belonging to Metawin. According to its statement, the credentials remained unchanged long after their original issue. The account allegedly still opened internal control panels and sensitive data stores.
The group also claimed that aggregate profit figures linked to the accounts exceeded $1 billion. It offered no calculation, reporting period or detailed explanation for that figure. Nor did it publish a full list of the 146 database fields.
Instead, WhiteArmor posted a downloadable JSON sample marked as 100 Gamdom account records. The listed file size was roughly 437 KB. Its demand called for $15 million in Bitcoin, with payment instructions to follow by email.
Gamdom Founder Disputes Full Database Breach
Romer rejects the claim that attackers obtained Gamdom’s complete database. He says the access affected a few hundred accounts, rather than the millions cited in WhiteArmor’s message.
Did WhiteArmor reach 15.4 million accounts or only the smaller group Romer described? The rival accounts leave the reported scale of the incident in dispute. The published sample alone does not demonstrate access to every claimed record.
Romer also said Gamdom shut down servers after the earlier attack to protect customer information. His explanation separates the company's stated response from WhiteArmor’s account of the alleged database theft.
Meanwhile, WhiteArmor has appeared only recently in cyber threat tracking. HackerFeeds first listed the group among monitored victims on October 21, five days before its Gamdom post.
The operation has advertised an affiliate program for hackers and security specialists. Under its stated arrangement, participants keep 95% of successful ransom payments, while WhiteArmor takes 5%.
It has also been named Whirlpool, J.B. Hunt and LoveSac in breach claims. Those listings do not independently prove successful intrusions.
Read More: Bitcoin Slips Below USD 80,000 as Traders Await Fed Verdict
Earlier Gamdom Wallet Hack Appears in Crypto Fund Probe
The new allegations follow Gamdom’s October 13 hot-wallet incident. Romer initially put losses above USD 3 million, while blockchain analysts estimated the missing assets at closer to USD 4.2 million.
Hot wallets stay online to handle transactions, including withdrawals. Their internet connections also create security risks that differ from those of offline storage.
Blockchain investigator ZachXBT later identified funds tied to the Gamdom exploit during a review of suspected laundering activity. A crypto.news report dated October 20 linked those assets to FreedomXMR, a cryptocurrency exchange service on Hyperliquid Core.
ZachXBT reported that more than 87% of the service’s incoming funds came from suspected illicit sources. He cited ransomware payments, exploits, malware and social engineering cases.
His examination of historical transfers above USD 10,000 traced more than USD 20 million to identified incidents. Those included the Gamdom attack and cases involving DCENT Wallet, Fetch.ai and Axelar.
The investigation also identified more than 3,000 exchange deposits connected to the service’s operations. The findings concerned the movement of suspected illicit funds, separate from WhiteArmor’s later claim of mass account access.
Conclusion
WhiteArmor claims it copied 15.4 million Gamdom accounts and wants USD 15 million in Bitcoin, but founder Felix Romer disputes the scale. The demand follows an October hot-wallet attack with losses estimated between USD 3 million and USD 4.2 million. The extent of the alleged database access remains unverified.