WhiteArmor demands $15M Bitcoin from crypto casino Gamdom

This demand surfaced on October 26, according to a post from the cybersecurity monitoring account Dark Web Informer, which detailed WhiteArmor's assertion that it possesses Gamdom's complete user database, which encompasses 15,420,003 accounts distributed across 146 database columns. As proof of their alleged infiltration, the group made public a sample comprising 100 account records, while simultaneously issuing the online casino a multimillion-dollar ransom.

These fresh claims come after Gamdom experienced a separate cryptocurrency wallet breach earlier this month, which reportedly resulted in losses ranging from $3 million to $4.2 million.

In a message posted on its leak site on October 26, WhiteArmor explained that its entry into Gamdom's systems was achieved via an outdated internal machine account that had maintained administrative permissions for several years. The attackers pinpointed this account as belonging to Metawin, noting that its credentials had never been updated, thus permitting access to sensitive data stores and internal control panels. This account, which was issued some time ago, remained active, enabling the assailants to navigate systems typically restricted to administrators.

WhiteArmor asserts that the database holds more than 15.42 million accounts and 146 columns of data, though they have refrained from offering a full public breakdown of the data fields they claim to have obtained. Furthermore, the perpetrators stated that the total profits linked to these accounts surpass $1 billion, without clarifying the methodology for this calculation or the time frame it covers. To substantiate their claims, the group released a downloadable JSON file, labeled as containing 100 Gamdom accounts, which measures approximately 437 KB. The message specifies a ransom of $15 million in Bitcoin, adding that payment instructions will be sent directly to the company via email.

Gamdom's founder, Felix Romer, has refuted the scope of the alleged security lapse, maintaining that the attackers did not manage to extract the platform's entire database. Romer's account suggests the intrusion was limited, affecting only a few hundred accounts, and noted that the company had taken the step of shutting down servers following the earlier attack to safeguard customer information.

WhiteArmor itself is a relatively new cyber extortion entity that began appearing on cybersecurity monitoring platforms in October 2026. Threat intelligence records from HackerFeeds indicate the group first appeared in its tracked victim listings on October 21, just five days prior to the Gamdom ransom demand being made public. This operation markets itself as a data theft collective and has reportedly been recruiting security specialists and hackers through an affiliate program, wherein participating attackers can keep 95% of the ransom payments, leaving the group with the remaining 5%. The group has claimed responsibility for breaches affecting several other companies, including Whirlpool, J.B. Hunt, and LoveSac, although those listings do not confirm the success of those alleged intrusions.

The purported database compromise follows an incident on October 13 involving Gamdom's cryptocurrency hot wallet, which led to the disappearance of several million dollars worth of digital assets. After this event, Felix Romer reportedly initially quantified the losses at over $3 million, while blockchain analysts estimated the stolen funds could be closer to $4.2 million. Hot wallets, by nature of being connected to the internet for transaction processing and routine withdrawals, face different security vulnerabilities compared to offline storage methods.

The earlier incident drew the attention of blockchain investigator ZachXBT, who subsequently traced funds connected to the Gamdom exploit while investigating suspected cryptocurrency laundering activities. As previously reported by crypto.news, an October 20 investigation tied the stolen assets to FreedomXMR, a cryptocurrency exchange service operating on Hyperliquid Core. ZachXBT discovered that over 87% of the service's incoming funds were connected to suspected illicit activities, such as ransomware payments, exploits, malware, and social engineering attacks. His scrutiny tracked more than $20 million in transactions linked to identified incidents, including the Gamdom exploit and attacks involving DCENT Wallet, Fetch.ai, and Axelar. The investigator reviewed historical incoming transfers exceeding $10,000 and identified over 3,000 exchange deposits associated with the service's operations.

Why it matters

This incident highlights the escalating security risks facing crypto platforms, with attackers leveraging old administrative credentials. Readers should watch how Gamdom responds to the ransom demand and if any further data is compromised.