Gamdom Hacker and WhiteArmor Speak to Gambling Lore About $15M Ransom

Gambling Lore has spoken directly with the hacker claiming responsibility for extracting Gamdom’s user database and the founder of WhiteArmor, the group publishing the $15 million ransom demand. The exchanges provide new details about the alleged theft, the division of roles behind the demand and the data being held.

The hacker, using the name “Veryso”, said they extracted approximately 15.4 million database rows on October 13, with records dating back to Gamdom’s earliest accounts in 2016. Gambling Lore verified that the supplied record contained accurate information of an account dating back 5 years ago. This confirms the authenticity of the account data checked, while the full claimed record count, method of intrusion and separate allegations about Gamdom’s provably fair system remain unverified.

WhiteArmor’s representative said they founded the group and described its motivation plainly: “It does not have any other goals except money.”

What Gambling Lore Verified

During the exchange, Gambling Lore supplied an account username for Veryso to look up. Veryso returned a structured record containing account creation and login timestamps, account status fields, betting activity and other account information. When asked for the complete entry, Veryso supplied a text-file attachment. Gambling Lore reviewed the record and verified that the supplied account information was accurate.

What the table showed

The file contains a single JSON account record with 146 fields, matching the column count stated in WhiteArmor’s public claim. It includes populated Steam identifiers and trade-link information, login timestamps, a last-login IP address and country, account status flags and betting-related values.

For this account, email, phone number, first name, last name and two-factor-secret fields are null, as is the active KYC-level field. The record does not contain identity-document files. These findings describe this sample only and do not establish what information exists for other accounts.

Gambling Lore also asked WhiteArmor to demonstrate control of its site. In response, the representative supplied a verification page on the site. The page, reviewed by Gambling Lore, states: “Verification for Gamblinglore.com.” This supports the link between the point of contact and the site carrying the demand.

Who Is Behind The Hack

The conversation seperated the person claiming to have extracted the data from the group presenting the ransom demand publicly. Veryso described a collaboration with WhiteArmor, while the WhiteArmor representative identified themselves as the group’s founder.

WhiteArmor said it did not have access to the full dataset and attributed the extraction and possession of the material to Veryso.

“I do not want to steal veryso’s work/credits,” the representative said, adding that Veryso “did everything & has access to everything associated with Gamdom.”

When asked when the database was extracted, Veryso answered “Oct 13th” and described it as “15,400,000 rows, 140+ columns.” WhiteArmor’s public listing gives a more precise claim of 15,420,003 accounts across 146 columns.

Veryso claimed the oldest record dated to October 22, 2016, describing it as Gamdom’s first account. Gambling Lore has not independently verified the age or completeness of the full dataset.

Veryso said they initially had no intention of pursuing a ransom, claiming they had “already made my money.” The statement did not explain how that money was obtained and does not establish responsibility for Gamdom’s earlier hot wallet losses.

Claimed Access Through a Wider Infrastructure 

WhiteArmor’s public statement attributed access to an internal machine account with administrative privileges, referencing “Metawin.” In the conversation, Veryso claimed access to a wider infrastructure cluster but said Gamdom was the only target with “open doors.”

We asked about a connection between Gamdom and MetaWin, Veryso described the businesses as neighbors and later said they shared a vendor. They declined to identify that vendor, calling it irrelevant to the case.

Veryso said Gamdom’s maintenance involved a broad cleanup and that they had since been unable to regain access.

The $15M Ransom Demand

Veryso said they first contacted Gamdom on October 22 through Telegram accounts they claimed belonged to senior administrators and were identified in the database. They said Gamdom had not responded and that they remained open to negotiation.

WhiteArmor’s public demand seeks $15 million in Bitcoin and threatens publication of the data. The listing displayed a November 9 release date and linked to a sample of 100 accounts.

Veryso claimed the partnership with WhiteArmor developed after they examined the database and Gamdom’s provably fair systems. WhiteArmor’s founder, separately, said the group’s objective was only financial.

The Provably Fair Allegation

Veryso alleged that Gamdom’s advertised provably fair mechanism did not exist as represented, saying they had extracted material that could be examined offline. They did not supply the technical evidence needed to substantiate that allegation in the conversation provided to Gambling Lore.

As part of that argument, Veryso claimed only 199 entries in the alleged database showed winnings exceeding one bitcoin, including several streamers. Gambling Lore has not independently verified that calculation. The meaning of the winnings measure, the treatment of inactive accounts and the period covered were not established. That alleged figure alone does not demonstrate manipulated games.

The Earlier $3M Breach

Gamdom previously acknowledged unauthorized server access after an investigation into a suspected disk failure uncovered an unauthorized connection to an automation server. The operator took its systems offline, and owner Felix Römer subsequently confirmed losses of just over $3 million from its hot wallet system.

The October 13 extraction date claimed by Veryso overlaps with the earlier incident, but the conversation does not establish that the database theft and hot wallet attack were carried out by the same person or through the same access route.

The new reporting establishes direct contact with the people behind the database claim and ransom publication, alongside Gambling Lore’s verification of sample account data. The full scale of the theft, the entry point and the separate allegations about the provably fair system remain unresolved.