Key Takeaways
- • Galaxy Digital's Head of Firmwide Research Alex Thorn publicly criticized Duel Casino for refusing to freeze approximately 230 ETH allegedly stolen through the Coldcard hardware wallet exploit, despite receiving forensic evidence linking the addresses to the theft.
- • Duel Casino stated it requires official law enforcement confirmation before freezing user funds, citing concerns that third-party claims alone could enable bad-faith fund freezes and system abuse.
- • The disputed 230 ETH represents a portion of a broader Coldcard exploit that has resulted in estimated losses between $70 million and $89 million stemming from a five-year-old firmware vulnerability in the Bitcoin-only hardware wallet manufactured by Canadian firm Coinkite.
- • The incident highlights operational friction between cryptocurrency researchers and gambling platforms regarding asset recovery protocols, with Galaxy Digital characterizing Duel's inaction as complicit in theft while the platform prioritizes procedural safeguards against false claims.
Summary
A dispute has emerged between Galaxy Digital and Duel Casino over the handling of cryptocurrency allegedly stolen through the Coldcard hardware wallet vulnerability. Alex Thorn, Head of Firmwide Research at Galaxy Digital, publicly criticized Duel Casino for refusing to block nearly 230 ETH that Galaxy Digital researchers claim originated from the Coldcard exploit. According to Thorn's account, Galaxy Digital provided forensic evidence linking the blockchain addresses and transactions to the incident, but Duel Casino declined to take action.
Duel Casino's position centers on operational risk management and regulatory procedure. A Duel team member identified as Korra stated on X that the platform cannot freeze user funds based solely on third-party claims of theft, as such a policy could be exploited by bad actors seeking to freeze legitimate customer balances. Duel Casino indicated it requires official law enforcement contact and confirmation before implementing fund freezes. Thorn characterized this stance as unacceptable, noting that police involvement would not materialize until at minimum the following Monday, creating a window for the stolen funds to be moved or further laundered.
The 230 ETH in dispute represents part of a significantly larger theft. Galaxy Digital's research has mapped a Coldcard exploit linked to a firmware flaw in the Bitcoin-only hardware wallet produced by Coinkite, with total estimated losses escalating to between $70 million and $89 million. The vulnerability, which persisted for approximately five years, allegedly allowed attackers to guess private keys without requiring physical access to the device. The incident underscores broader challenges within the cryptocurrency ecosystem regarding the coordination between security researchers, custodial platforms, and law enforcement in responding to active theft and asset recovery scenarios.
Duel Casino's position centers on operational risk management and regulatory procedure. A Duel team member identified as Korra stated on X that the platform cannot freeze user funds based solely on third-party claims of theft, as such a policy could be exploited by bad actors seeking to freeze legitimate customer balances. Duel Casino indicated it requires official law enforcement contact and confirmation before implementing fund freezes. Thorn characterized this stance as unacceptable, noting that police involvement would not materialize until at minimum the following Monday, creating a window for the stolen funds to be moved or further laundered.
The 230 ETH in dispute represents part of a significantly larger theft. Galaxy Digital's research has mapped a Coldcard exploit linked to a firmware flaw in the Bitcoin-only hardware wallet produced by Coinkite, with total estimated losses escalating to between $70 million and $89 million. The vulnerability, which persisted for approximately five years, allegedly allowed attackers to guess private keys without requiring physical access to the device. The incident underscores broader challenges within the cryptocurrency ecosystem regarding the coordination between security researchers, custodial platforms, and law enforcement in responding to active theft and asset recovery scenarios.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.