On This Day: MetaWin Lost $4 Million in a Hot-Wallet Exploit

Two years ago today, MetaWin disclosed a theft initially estimated at approximately $4 million from its Ethereum and Solana hot wallets. The attacker had exploited the casino’s “frictionless withdrawal system,” according to founder and CEO Richard “Skel” Skelhorn.

The immediate priority was to stop further withdrawals and replace the missing funds. Three weeks later, Skelhorn took the search for the attacker public, offering a Bugatti he valued at $4.5 million as a conditional reward.

The incident became an early example in the run of crypto casino breaches that would include CoinPoker that same month, followed by further attacks on operators including Duelbits and Gamdom.

How the Withdrawal System Was Exploited

MetaWin’s withdrawal system was intended to let customers retrieve funds with minimal friction, this is what allowed the hacker to drain millions swiftly.

Halborn’s November 5 analysis identified a vulnerability in that process, citing Skelhorn’s account. Its report placed the failure in MetaWin’s withdrawal infrastructure, rather than in the Ethereum or Solana networks themselves.

Blockchain investigator ZachXBT associated approximately 115 addresses with the theft and traced funds to KuCoin and a service nested within HitBTC. PeckShield’s November 4 alert also listed Base among the affected networks, alongside Ethereum and Solana.

Those findings helped document the movement of the money. They did not identify the attacker. Halborn’s public account also did not set out the exact code-level flaw or a reproducible sequence of exploit transactions.

The Pause, the Top-Up and Skel’s First Response

MetaWin temporarily suspended withdrawals while it assessed the attack and secured its systems. In a community update, Skelhorn said access had already been restored for 95% of users, with final checks continuing on the remaining accounts.

He said wallet balances were being topped up and promised additional security controls for new users, while trying to preserve a smoother experience for the existing community. That was the operational compromise he described: tighten access without abandoning the convenience the platform had been built around its withdrawal system.

In a message reported by The Block on November 3, Skelhorn wrote: “I just emptied my piggy bank, we don’t dwell on it. We keep building.” Skel topped up the hot wallets from his own funds, reassuring players that business had resumed as per usual.

Skelhorn also said authorities had been contacted and that internal adjustments would follow. The message to customers was that MetaWin would absorb the loss and keep operating.

Three Weeks Later, a Bugatti Bounty

On November 25, Skelhorn published an X post offering his Bugatti Chiron Pur Sport as a reward. By then he described the theft as $4.5 million, a higher figure than the roughly $4 million reported on the day of the attack. 

The conditions went beyond supplying a name. He wanted actionable evidence identifying the hacker that would lead to an arrest, charges and subsequent recovery of the stolen funds. The offer required a lawful route to that outcome.

Skelhorn also said he could tokenize the car’s ownership, allowing the recipient to trade or sell its title rather than take physical delivery. He said it would be similar to MetaWin’s previous Cybertruck competition as the model for that reward.

The post expressed frustration with law enforcement. Skelhorn said he believed a crypto theft was receiving less serious treatment than an equivalent bank robbery.

The Wider Pattern

The breaches and drains didn't stop with MetaWin in 2024. In our recent interview with Duelbits CEO Jasper, he described a roughly $7 million hot-wallet theft and an outage lasting about three days.

Jasper also questioned the use of large public hot-wallet balances as a measure of trust, saying some operators held more online than their withdrawal needs required. The incentive is clear: visible money can reassure customers, while more money held in an exposed system can increase the damage when attacker come about.

Gamdom’s October 2026 breach extended beyond stolen funds. Founder Felix Römer told Gambling Lore that estimated theft had reached approximately $4.27 million, while the company reported roughly 16 million extracted player records and exposure through its Intercom support system.

These were separate incidents with different public explanations. Together they show a growing problem across the industry with security and the rapid growth in AI systems enabling attackers to rigorously look for weak points in a platform's systems.