Duel Casino Refuses to Freeze Stolen ETH Linked to Coldcard Vulnerability
A recent Coldcard vulnerability exploit has led to nearly 230 ETH being allegedly stolen from its victim, which then moved to Duel Casino. According to Alex Thorn, Head of Firmwide Research at Galaxy Digital, this amount was already on the move and had hit third-party platforms as part of a laundering effort.
Duel Casino refused to freeze these funds even after receiving data linking the addresses and transactions to the event. When questioned about their decision, Duel's team member Korra stated that they require official law enforcement confirmation before blocking user balances, citing the possibility of false claims being made against users' accounts.
Gabriel Shapiro, former Delphi Digital CLO, supported Duel Casino's stance, saying it is 'probably my only unpopular view but I still think this is pretty much the only sane policy a crypto-adjacent fintech app can have.' Thorn was critical of Duel's inaction, calling it 'outrageous' and 'complicit in theft.'
As more wallets are drained and threat actors seek to cash out their share of the over 1,300 BTC stolen, this incident highlights the challenges faced by companies and institutions in navigating these complex situations.