Crypto gambling platform Gamdom has been targeted by cyber extortion group WhiteArmor, which claims to have accessed more than 15.4 million user accounts and is demanding $15 million in Bitcoin to settle the alleged breach.
Summary
- WhiteArmor claims to have accessed more than 15.4 million Gamdom user accounts through an old internal machine account that allegedly retained administrative privileges for years.
- The cyber extortion group is demanding $15 million in Bitcoin and has published a sample containing 100 account records as evidence of its alleged access.
- Gamdom founder Felix Romer has disputed the extent of the alleged breach, maintaining that the attackers accessed only a few hundred accounts rather than the entire database.
- The allegations follow an October 13 hot wallet exploit that reportedly cost Gamdom between $3 million and $4.2 million in cryptocurrency.
According to an October 26 post shared by cybersecurity monitoring account Dark Web Informer, WhiteArmor claims to possess Gamdom’s entire user database, containing 15,420,003 accounts spread across 146 database columns.
— Dark Web Informer (@DarkWebInformer) October 26, 2026‼️🇨🇷 WhiteArmor claims access to Gamdom’s full user database and is demanding $15 million in Bitcoin.
🇨🇷 Gamdom – An online casino and sportsbook founded in 2016, offering crypto-based casino games, sports betting, and esports wagering.
The listing claims 15,420,003 user… pic.twitter.com/cFdoLxqZfq
The group has published a sample containing 100 account records as evidence of its alleged access, while threatening the online casino with a multimillion-dollar ransom demand.
The latest allegations follow a separate cryptocurrency wallet hack earlier this month that reportedly cost Gamdom between $3 million and $4.2 million.
WhiteArmor claims access to Gamdom’s entire user database
In a message published on its leak site on October 26, WhiteArmor claimed that it gained access to Gamdom’s systems through an old internal machine account that had retained administrative privileges for years.
WhiteArmor ransom demand. Source: X/DarkWebInformer
The group identified the account as belonging to Metawin, claiming that its credentials had never been rotated and that it still provided access to internal control panels and sensitive data stores.
According to the message, the account had been issued years earlier but remained active, allowing the attackers to move through systems that would normally be restricted to administrators.
WhiteArmor claims the database contains more than 15.42 million accounts and 146 columns of information, although it has not provided a complete public breakdown of the data fields allegedly obtained.
The attackers further claimed that the combined profit values associated with the accounts exceeded $1 billion, without explaining how that figure was calculated or what period it covered.
As evidence, the group published a downloadable JSON file labeled as containing 100 Gamdom accounts, with the sample listed at approximately 437 KB.
The message demands $15 million in Bitcoin and states that payment instructions will be delivered directly to the company by email.
Gamdom founder Felix Romer has disputed the extent of the alleged compromise, maintaining that the attackers did not extract the platform’s complete database.
According to Romer’s account, the incident involved limited access affecting a few hundred accounts, while the company shut down servers following the earlier attack to protect customer information.
WhiteArmor emerges as a new cyber extortion group
WhiteArmor is a relatively new cyber extortion operation that began appearing on cybersecurity monitoring platforms in October 2026.
Threat intelligence records from HackerFeeds show that the group first appeared in its tracked victim listings on October 21, just five days before the Gamdom ransom demand was published.
The operation has presented itself as a data theft group and has reportedly been recruiting hackers and security specialists through an affiliate program.
Its advertised arrangement allows participating attackers to retain 95% of successful ransom payments, leaving the remaining 5% for the group.
WhiteArmor has claimed responsibility for breaches involving several other businesses, including Whirlpool, J.B. Hunt, and LoveSac, although those listings do not establish that the alleged intrusions were successful.
Gamdom previously lost millions in a crypto wallet hack
The alleged database compromise follows an October 13 incident involving Gamdom’s cryptocurrency hot wallet, which resulted in the loss of several million dollars in digital assets.
Following the incident, founder Felix Romer reportedly placed the initial losses at more than $3 million, while blockchain analysts estimated the stolen funds could be worth closer to $4.2 million.
Hot wallets are connected to the internet to process transactions, making them useful for withdrawals and other routine operations but exposing them to different security risks than offline storage.
The earlier incident attracted attention from blockchain investigator ZachXBT, who subsequently identified funds associated with the Gamdom exploit while examining suspected cryptocurrency laundering activity.
As previously reported by crypto.news, an October 20 investigation linked the stolen assets to FreedomXMR, a cryptocurrency exchange service operating on Hyperliquid Core.
ZachXBT found that more than 87% of the service’s incoming funds were associated with suspected illicit activity, including ransomware payments, exploits, malware, and social engineering attacks.
His investigation traced over $20 million in transactions connected to identified incidents, including the Gamdom exploit and attacks involving DCENT Wallet, Fetch.ai, and Axelar.
The investigator examined historical incoming transfers exceeding $10,000 and identified more than 3,000 exchange deposits connected to the service’s operations.