WhiteArmor Demands $15 Million Bitcoin Ransom from Casino Gamdom

The threat surfaced on October 26 when WhiteArmor published a sample of 100 account records as proof of its intrusion. The group claims these records were pulled from a massive database containing 146 columns of user information. According to the attackers, they exploited an old internal machine account linked to Metawin that had failed to rotate credentials for years, granting them unrestricted access to sensitive internal control panels.

Gamdom founder Felix Romer has publicly challenged the scale of the incident. While the extortionists insist they possess a complete database of 15,420,003 accounts, Romer maintains that the actual breach was limited to only a few hundred records. The platform had already been in a defensive posture following an October 13 hot wallet exploit that resulted in the loss of between $3 million and $4.2 million in digital assets.

WhiteArmor, which appeared on the threat landscape only days before the Gamdom demand, operates through an affiliate model that promises hackers a 95% cut of any successful ransom. The group has listed several other high-profile companies as victims, though the veracity of those claims remains under investigation. Meanwhile, blockchain sleuth ZachXBT has linked previous losses at Gamdom to a wider network of illicit funds flowing through the FreedomXMR exchange, highlighting the persistent security challenges facing the platform.