Bitcoin ransomware: crypto casino targeted with $15 million ransom

Coin Encyclopedia Improve your knowledge of cryptos

Called WhiteArmor, it claims to have 15.4 million accounts and demands $15 million in bitcoin. Gamdom disputes the extent of the leak in a sector which has not forgotten the $41 million Stake heist.

All current Gate EU bonuses in one place, cumulative with the Rewards Hub (10,000+ USDC) Take advantage of Gate EU bonuses Commercial link

The announcement fell on October 26, 2026 on the WhiteArmor leak site. This is the showcase where ransomware groups expose their victims to increase the pressure.

The hackers say they have 15,420,003 accounts spread across 146 columns of data. They also put the “cumulative profit value” of Gamdom at more than a billion dollars, without ever explaining this calculation.

The request is in one line: $15 million in BTC. Payment instructions will arrive “directly by email,” specifies the announcement archived by ransomware.live. A countdown of approximately two weeks runs below the announcement before the data is released.

WhiteArmor says it was entered by a machine account with administrator rights. This account would have been created years ago without anyone ever renewing their login details.

As proof, the group published a sample of 100 accounts. Dark Web Informer, the X account which relayed the announcement, specifies that no one has yet verified this file.

The pattern is that of double extortion. Hackers steal data, encrypt systems, then charge twice: to provide access and not to publish.

WhiteArmor appeared less than a week ago. Its first claims date from October 21 to 23 according to the trackers, and the group already cites Whirlpool and J.B. Hunt among its victims. The ransomware.live site itself recommends treating its ads “with caution” until they are verified.

The timing stings. On October 13 around 3:50 p.m. UTC, Gamdom hot wallets began to empty. These are the permanently connected wallets that are used to pay for players' current withdrawals.

The site cut off access in the evening. The next day, the platform reported a disk failure and an “unauthorized connection to one of [its] automation servers”.

Its founder Felix Romer put the loss at “a little over $3 million”. On-chain investigator vxdb counted $4.2 million released across eight networks, including $2.2 million on Ethereum-compatible chains and nearly a million on Solana.

Gamdom reopened on October 16 with a shower of bonuses to bring players back. Without publishing the slightest proof of reservations.

Nothing officially links the two cases. WhiteArmor does cite the October hack in its announcement, but the entry point it describes does not correspond to that mentioned by Gamdom.

Machine-translated from French