Duelbits Co-Founder Offers Hacker $2 Million to Return Stolen Funds

Duelbits co-founder Joe has renewed an offer allowing the hacker behind the casino’s September 24 breach to retain $2 million in exchange for returning the rest of approximately $7 million stolen.

Writing on X, Joe said some of the stolen funds had been frozen on websites and exchanges. He did not name those services or specify how much money was affected.

He presented the proposal as an opportunity to settle the matter, warning that otherwise he would pursue the attacker and seek full recovery. The terms imply the return of approximately $5 million.

Frozen Funds Remain Unspecified

Joe’s statement provides no breakdown of the assets reportedly frozen, their locations or the process required to return them.

A freeze can restrict access to funds while leaving their eventual recovery unresolved. His announcement therefore does not establish how much Duelbits has recovered from the theft.

The proposed $2 million retention would also depend on the attacker accepting the arrangement and returning the remaining funds. No completed agreement or repayment was disclosed in the statement.

Earlier Settlement Proposal Appeared on October 8

The renewed approach follows a settlement proposal reported on October 8.

According to TokenPost, an on-chain message attributed to Duelbits claimed the company had traced stolen funds and identified suspected participants, associated wallets, exchanges and accounts.

That proposal offered an agreed share of the funds in return for repayment under a formal agreement. The message said Duelbits would refrain from pursuing further legal action once the conditions were fulfilled. The report did not establish that an agreement had been signed or funds returned. 

Joe’s latest statement places a specific $2 million figure on the proposed settlement. Whether the attacker responded to the earlier approach remains unclear.

September Breach Targeted Hot Wallets

Duelbits disclosed the attack on September 24, with Joe estimating losses at approximately $7 million.

Initial reporting described suspicious transfers from hot wallets across several blockchains. Blockchain security company Scam Sniffer identified a suspected private-key compromise, while Joe said the company was investigating how the breach occurred. 

The casino temporarily suspended operations. It subsequently announced on September 27 that deposits and withdrawals had resumed, reporting approximately $8 million across hot and cold wallets at relaunch. 

The current recovery effort concerns funds taken during that breach. Joe’s latest offer leaves the amount frozen, the attacker’s response and the outcome of any settlement undisclosed.