Gamdom $15m Bitcoin Ransom: What the Data Claim Means

A ransom demand lands two weeks after the wallet hack

A data theft group calling itself WhiteArmor posted on its leak site on 26 October 2026 that it holds Gamdom's user database, and it wants $15 million in Bitcoin to keep it private. The listing claims 15,420,003 accounts across 146 database columns, according to crypto.news, which reported the demand on 27 October. KuCoin's news desk put the ask at 1,500 BTC.

This is a second, separate problem from the hot wallet breach of 13 October, when Gamdom went offline for more than two days and its founder put the loss at just over $3 million. That incident drained the casino's own operating wallets. This one, if the claim holds, is about players' personal data and betting histories, which cannot be put right with a balance top-up.

The proof published so far is thin: a JSON file of about 437 KB that WhiteArmor says contains 100 Gamdom accounts. The group also claims the accounts carry combined profit values above $1 billion, without saying how it worked that out. Neither the full database nor the 15.4 million figure has been independently verified, and no ransom payment has been reported.

How WhiteArmor says it got in

WhiteArmor says it entered through an old internal machine account linked to Metawin whose credentials were never rotated and which kept administrative access for years. It claims that account reached internal control panels and stored secrets, as summarised by Gambling.com. Gamdom has not publicly confirmed or denied that route, and Metawin is named only in the group's own claim.

The group is new. Monitoring records cited by crypto.news first list it on 21 October 2026, five days before the Gamdom post, and it recruits affiliates who keep 95% of any ransom paid. It has also listed Whirlpool, J.B. Hunt and LoveSac as victims, but a listing on a leak site does not prove an intrusion succeeded. Ransomware.live, which tracks such sites, advises treating its claims with caution.

What Gamdom says was exposed

Gamdom's position has moved during the week. Founder Felix Römer first disputed the scale, saying the attackers reached only a few hundred accounts and that the full database remained secure. Later statements, reported by Bitcoin.com News on 27 October, acknowledged that usernames, email addresses and gambling activity may have been exposed, while identity verification documents were not affected.

Bitcoin.com News also cites Gambling Lore, which reported that a hacker using the name Veryso claimed to have taken records on 13 October, the day of the wallet breach, and that the outlet checked one long-standing user's record containing login timestamps, an IP address and betting information. One matching record supports the claim that some real data is out; it does not establish the 15.4 million figure. Gamdom has not said whether it will pay, and no regulator statement on the incident has been published.

Player reports after the breach

Trustpilot shows five reviews of Gamdom dated 20 to 24 October 2026, all one star, as of 29 October. One reviewer on 24 October reports that funds were moved from his balance to a wallet not linked to his account and that support denied responsibility; Gamdom had not replied on the page. That is a single unverified report, and it is not clear whether it is connected to either incident.

Gamdom did reply to other reviews in the same window. To a 22 October reviewer who reports $500 taken and an account reset after a verification request, it said account actions follow its terms and asked the player to contact support. Trustpilot itself shows no score for Gamdom, saying the rating is unavailable because of a breach of its guidelines and that it removed fake reviews; the page lists 5,133 reviews in total.

The bad news

Two security incidents in one month is the story here. A wallet drain of $3 million or more on 13 October, then a credible if unproven claim that player data left with it. The founder's own account has shifted from a few hundred accounts to conceding that emails and betting histories may be exposed. Gamdom's licence is offshore (sources list Anjouan, with older Curaçao records), so players have limited formal routes if they want to complain about how their data was handled.

The good news

Gamdom says identity documents were not affected, and it came back online on 16 October saying balances were protected. Its founder has spoken publicly about both incidents rather than staying silent, and the casino continues to answer most negative Trustpilot reviews. Nothing published this week shows a regulator action against it, and the 15.4 million figure comes only from the group demanding the money.

What players can do and what to watch next

If you have ever had a Gamdom account, change that password now, and change it anywhere you reused it. Gambling.com gives the same advice. Turn on two-factor authentication where the site offers it, and treat emails that mention your Gamdom username or betting history as possible phishing: a leaked email and gambling record is exactly what scam messages use. Crypto transfers are final, so never send coins to an address from an unexpected message.

Watch for three things: whether WhiteArmor publishes more data, whether Gamdom gives a full account of what was taken and how many players are affected, and whether any regulator steps in. Our rating stays Mixed for now while the claims are unproven; the full background is in our Gamdom review, and the wider field is on the crypto casinos hub and the streamer casinos page.

Gamdom is a streamer-led brand whose current headline Kick face is SteveWillDoIt, and sponsored streamers often play with balances the casino provides. Gambling is for over-18s only, and help is at BeGambleAware. UK players should know Gamdom holds no UK Gambling Commission licence, so GAMSTOP and UKGC protections do not apply there.

Sources

FAQs

Was Gamdom hacked again in October 2026?

Gamdom faces a second incident. After its hot wallets were drained on 13 October, a group called WhiteArmor posted on 26 October that it holds Gamdom's user database and demanded $15 million in Bitcoin. Gamdom disputes the scale, but its founder later accepted that usernames, email addresses and gambling activity may have been exposed. The full claim is unverified.

How many Gamdom accounts were leaked?

Nobody has proven a number. WhiteArmor claims 15,420,003 accounts across 146 data columns, but it has published only a sample of about 100 records. Gamdom's founder first said only a few hundred accounts were reached. One outlet checked a single real user record, which shows some data is out but does not confirm the 15.4 million figure.

Were Gamdom KYC documents stolen?

Gamdom says no. Its founder has said identity verification documents were not affected, while conceding that usernames, emails and betting activity may have been. That statement has not been independently checked. If you uploaded ID to Gamdom, watch for phishing that uses your details and change any reused passwords as a precaution.

Is my Gamdom balance safe after the hack?

Gamdom said user balances were protected when it reopened on 16 October after the wallet breach, and the ransom claim is about data rather than funds. One Trustpilot reviewer reports coins moved from his balance on 24 October without a reply from Gamdom, which is unverified. Crypto transfers are final, so keep balances on any casino small.

What should Gamdom players do now?

Change your Gamdom password and any password you reused elsewhere, turn on two-factor authentication, and be wary of emails or messages quoting your username or betting history. Never send crypto to an address from an unexpected message. Gambling.com gives the same password advice. Gamdom has not issued a full breach notice to players.

18+ only. Gambling can be addictive; set limits and never chase losses. Free, confidential support: BeGambleAware.

Gamdom Faces a $15m Bitcoin Ransom Over Claimed User Database