Galaxy Digital and Duel Casino Clash Over 230 ETH Linked to Coldcard Exploit
Funds linked to the Coldcard vulnerability exploit have moved to third-party platforms as criminals attempt to launder them. Alex Thorn, Head of Firmwide Research at Galaxy Digital, called out Duel Casino, an online gambling platform, for allegedly receiving nearly 230 ETH from the hack and refusing to freeze the assets.
Thorn stated that Duel Casino had access to data linking the addresses and transactions to the exploit but still declined to act. The platform reportedly asked for police to contact them, despite Thorn noting that no police report would arrive until Monday at the earliest. He labeled Duel’s inaction as outrageous, saying, “If they do not freeze the funds, they are complicit in theft.”
A Duel team member identified as Korra on X explained that the platform cannot freeze user funds based solely on a third-party claim, as it could be exploited by bad actors. Korra offered an exception if the alleged victim sent a message from the hacked address, signed an affidavit, and provided a clear trail of the funds entering Duel’s wallets. “We require some sort of official confirmation that an actual theft occurred (so confirmation from law enforcement of any kind usually),” Korra emphasized.
While some users criticized Duel for not issuing a temporary block while investigating, Korra stood firm: “We don’t freeze your Duel balance because someone asked us to. We simply don’t.”
Former Delphi Digital CLO Gabriel Shapiro supported Duel Casino’s stance, calling it “the only sane policy a crypto-adjacent fintech app can have.”
As more wallets are drained and threat actors attempt to cash out portions of the over 1,300 BTC stolen, similar dilemmas are expected to arise for users, companies, and institutions.