Inside Gamdom’s Breach: Felix Römer on the Attack and Their Response

Felix Römer has spent much of the last two weeks overseeing Gamdom’s response to the attack and the investigation into its extent.

The discussion covers the stolen funds, the site’s downtime and the exposure of player and support data. Römer explains Gamdom’s response and which findings were still being investigated.

Römer put the stolen funds at about $4.27 million. Gamdom’s team said its review of database logs showed roughly 16 million player records had been extracted, slightly more than the 15.4 million claimed in the public ransom demand on WhiteArmor’s site.

Römer also confirmed the breach through Intercom, Gamdom’s customer-support platform. He said a credential associated with a former head of support had been missed when the team rotated its access credentials after the attack.

The interview follows Gambling Lore’s conversations with the hacker who claims to have extracted the data and WhiteArmor’s founder, whose group published the $15 million demand.

How the Attack Unfolded

Gamdom’s timeline places initial internal access the previous evening, before the morning alerts Römer described.

According to the timeline of events, the attacker reached an internal admin service through Gamdom’s staging environment at 21:51 UTC on October 12. Credentials were sent outside its systems shortly after midnight. The attacker then used a stolen deployment-integration key to push changes into production and later reused a stolen session to reach production servers.

The timeline supplied for this interview records the team investigating and rotating credentials by 06:49 UTC on October 13. It then shows Bitcoin wallet signing information being exported around 13:21–13:22, followed by bulk account-export queries between 15:21 and 16:48.

Gamdom’s timeline identifies 87 withdrawal transfers between 15:51:41 and 17:40:23 UTC on October 13 and estimates outgoing funds at approximately $4.27 million.

Gamdom’s team stated that the attacker could write to the database to create account balances, then use user accounts to request withdrawals and admin accounts to approve them.

The team initially put the losses at around $3 million. The estimate later rose to approximately $4.27 million as the team identified additional losses, including the funds drained from its internal Bitcoin and Litecoin nodes. Some outgoing transfers remain under review.

48 hours offline

Account access and withdrawals were priorities, he said, so customers who felt uncomfortable could retrieve their funds.

Gamdom’s team said servers were placed into rescue mode to block outside access while secrets and API credentials were rotated. Attempts to use those credentials continued afterward. Römer also described separating services onto different servers as part of the remediation. The timeline records affected processes being shut down at 18:24–18:30 UTC on October 13, with withdrawal-queue manipulation recorded through 18:30.

Römer said he focused on supporting the technical team and identifying ways to strengthen Gamdom’s security.

The timeline Gamdom provided records removal of the compromised deployment integration and revocation of its tokens on October 14. It also records another attack attempt on October 16 that the team detected and contained it, with no new theft identified.

Investigating the Scale of the Breach

Römer said the team initially believed the attacker had retrieved only a small number of accounts, including administrator and moderator accounts.

Later reviewing the activity showed account data being retrieved in batches of 50,000.

He says the scale of the extraction became clear after the immediate containment work. Its timeline dates the bulk account-exporting to 15:21–16:48 UTC on October 13.

Gamdom’s team confirmed that roughly 16 million records had been exported, slightly exceeding the publicly claimed figure by the extortion group WhiteArmor.

Römer said the changing picture has made communication harder: information the company initially believed was accurate could be contradicted once more of the breach was discovered.

The support credential missed in the cleanup

Intercom created a separate problem. When asked about the hacker’s claim to have support conversations through October 27, Römer said the attacker had used an API credential associated with a former head of support.

Römer said third-party credentials had been harder to identify and rotate than credentials within Gamdom’s own systems. Gamdom’s team also said the attacker had cracked a weak password hash for an administrator account.

The team had received no security notification about the Intercom data export.

The hacker told Gambling Lore they were extracting 1,791,044 support conversations dated February 24, 2023 through October 27, 2026. Römer indicated that the count and date range appeared consistent with Gamdom’s findings.

Historical KYC files inside support chats

Römer explained that, unbeknownst to him, support staff had processed KYC submissions through Intercom in certain cases to resolve verification issues quickly, including when customers were flagged for suspected abuse that had not submitted documents through the usual verification link. Documents remained in some chats where support agents had not removed them. He added that support records must be retained to meet legal obligations, including responding to law-enforcement requests in investigations involving stolen funds.

Gamdom’s team said most KYC data is now held with that third-party provider and had not been accessed by the attacker.

Gamdom’s team estimates that about 4% of its KYC processing took place through Intercom, accounting for approximately 7,000 exposed documents.

From a $50,000 approach to a $15 million demand

In Gambling Lore’s earlier conversations, the hacker had said they reached out to Gamdom administrators but that outreach had gone unanswered. supr3me asked Römer for his account of those approaches.

He said the $15 million demand appeared when the claim was published on WhiteArmor’s website.

Römer says the person contacting staff used private Telegram identifiers taken from its system. Those direct approaches prompted the team to take the claims more seriously.

Why Gamdom Won’t Pay

When asked about communicating with the hacker demanding payment, Römer questioned what Gamdom would gain from engaging with them. He said their objective was to obtain money and that paying would not resolve the breach.

He also said that a successful ransom demand would give the people responsible an incentive to target other companies.

Römer described the response as focusing on what Gamdom could change after the data had been taken: securing its systems and requiring password and two-factor authentication updates.

Gamdom’s Security Response

Römer said Gamdom is enforcing password resets and changes to two-factor authentication.

Gamdom’s team is also identifying vulnerable passwords and proactively requiring affected users to reset them.

Römer emphasized that the exposed passwords were hashed, meaning they weren’t stored in a readable form. The team identified weak or reused passwords as a concern.

Gamdom Rejects the MetaWin Link

The hacker had described access to a wider infrastructure cluster and claimed Gamdom and MetaWin shared a vendor. When asked about that alleged connection, Römer rejected it.

He explained that the attacker had tried URLs containing MetaWin’s name while probing for a vulnerable endpoint. Those requests had not led anywhere and does not establish a connection between the businesses.

The Provably Fair Claims

The hacker had alleged that Gamdom’s provably fair system did not work as advertised and referred to code that could cancel bets above a particular multiplier. They had also said the alleged cancellation code appeared unused.

Römer said the hacker may have confused Crash’s maximum-win cap with a fairness issue. He explained that the cap automatically cashes out large bets when the round’s configured profit limit is reached; it does not cancel those bets or erase their winnings.

He said the cap does not affect the random-number generation used to determine round outcomes, which players can check using the site’s fairness verifier. According to Römer, the cap ensures the return to player (RTP) and expected value (EV) remain unchanged.

Römer disputed the hacker’s separate claim that only 199 accounts showed winnings above one bitcoin, including streamers. He questioned the metric and whether it represented only one wallet or currency.

Gamdom’s team said its log review indicated that the attacker had read the users table, rather than the tables containing betting records.

A warning to other operators

Römer also raised concerns about the wider security risks facing crypto businesses. He suspected AI had helped the attacker and warned that other operators could face similar attempts.

Römer’s warning came as other crypto businesses were facing security concerns of their own. Later on October 29, after the interview, Binance said it was investigating a potential security incident. The exchange estimated the total impact at around $6.3 billion, with approximately $3 billion frozen on-chain.

What Players Can Expect Next

The exposed information varied between accounts, from contact details and password hashes to documents submitted through support. With some customers facing a more extensive exposure than others, supr3me asked how Gamdom was communicating the findings to its users.

Römer said email updates would accompany a fuller statement. At the time of the interview, Gamdom was enforcing password and two-factor authentication resets, and working towards customer notices explaining what data had been exposed. He also said the response might extend beyond email.

Closing note

Römer’s account describes the work involved in containing the attack, restoring Gamdom’s services and establishing what information had been taken. He and Gamdom’s team outlined the security changes made during the response and acknowledged where the investigation was still ongoing.

Gamdom is now preparing a fuller statement and customer notifications. For Römer, the immediate priorities have been securing the platform and giving players a clearer understanding of the incident and the steps being taken in response.