WhiteArmor Demands $15M Bitcoin From Gamdom
A newly active extortion group called WhiteArmor says it has stolen the full user database of crypto casino Gamdom and wants $15 million in Bitcoin to keep it private. The claim is disputed. Gamdom's founder says the attackers reached only a few hundred accounts, and nobody independent has verified the larger figure.
The demand follows a separate attack on the operator earlier this month. For another recent security story in the sector, see our report on GGPoker banning third-party software after a security incident.
WhiteArmor posted the demand on its leak site on October 26, 2026. The listing, which is tracked by Ransomware.live, says the group holds 15,420,003 accounts across 146 database columns, with combined profit values on the accounts above $1 billion.
It does not explain how that profit figure was calculated. Ransomware.live adds that WhiteArmor is an emerging group, so its claims should be treated with caution until independently verified.
What WhiteArmor Is Claiming
According to the listing, the group got in through an old internal machine account that it links to Metawin. It says the account was issued years ago, kept administrative reach and was never rotated, which gave access to internal control panels and stored secrets.
As evidence it published a 437 KB JSON file that it says holds 100 Gamdom accounts, crypto.news reported. The group says payment instructions will be emailed to the company directly.
WhiteArmor has not published a full breakdown of the data fields it says it took. That matters for anyone with an account, because the real risk depends on what each record contains, and so far only the group's own description is available.
Gamdom's Response
Gamdom founder Felix Romer disputes the scale of the compromise. Crypto.news reports that he says the attackers accessed only a few hundred accounts and that the full database remains secure, and that servers were shut down earlier in the month to protect customer information.
That earlier incident began on October 13, 2026. In a post on October 14, Romer said the operator noticed a breach of its hot wallet system, acted to stop the drain and lost just over $3 million. Gamdom's own account said that about 24 hours earlier it had detected a possible disk failure, then found an unauthorised connection on one of its automation servers, and took all systems offline as a precaution. It said user funds were safe.
On-chain analysts put the wallet losses higher. Crypto.news puts the range at $3 million to $4.2 million, and says blockchain investigator ZachXBT tracked the stolen funds. It adds that a large share was linked to a service called FreedomXMR on Hyperliquid Core, which it says has been tied to other crypto exploits and ransomware payouts.
Casino Games Hub
Who Is WhiteArmor
Crypto.news cites HackerFeeds records showing WhiteArmor first appeared in tracked victim listings on October 21, 2026, five days before the Gamdom post. The group presents itself as a data theft operation and runs an affiliate programme in which participating attackers keep 95% of successful ransom payments. It has also listed Whirlpool, J.B. Hunt and LoveSac, although listings alone do not show those intrusions succeeded.
It is not the first time a gambling-sector target has had to explain a hack to its users. Our earlier report on the Curaçao regulator shutting down its licensing portal after a hack covered another recent case.
The outcome of the extortion attempt is unclear. Gamdom has not said whether it will pay, and no independent party has confirmed how many accounts were exposed.
Anyone with a Gamdom account may want to review the password they use there and on any site where they reused it. Players weighing where to play can also compare operators in our guide to licensed online casinos.
