WhiteArmor, a cyber extortion collective, asserts it has compromised over 15.4 million accounts on the Gamdom crypto gambling site and is seeking $15 million in Bitcoin to resolve the suspected incident. The group states that this access was gained through an obsolete internal machine account which reportedly maintained administrative rights for multiple years.
To substantiate its allegations of access, the cyber extortion group has published a sample file containing 100 account records while simultaneously demanding $15 million in Bitcoin. Felix Romer, the founder of Gamdom, has contested the severity of the reported breach, arguing that attackers compromised only a few hundred accounts instead of the full database as suggested by WhiteArmor. These accusations emerge shortly after an October 13 exploit of Gamdom's hot wallet, an incident that reportedly resulted in losses between $3 million and $4.2 million in cryptocurrency.
WhiteArmor's Demands
On October 26, a cybersecurity monitoring entity known as Dark Web Informer circulated a statement from WhiteArmor asserting possession of Gamdom's full user database. This dataset reportedly includes 15,420,003 accounts distributed across 146 columns. To substantiate their claim, the group released a sample file with 100 records and issued a threat involving a multimillion-dollar ransom to the online casino.
These new accusations come after an earlier incident involving a cryptocurrency wallet compromise that is said to have resulted in losses ranging from $3 million to $4.2 million for Gamdom. On October 26, WhiteArmor stated via its leak platform that it entered Gamdom's systems using an aged internal machine account that allegedly held administrative rights over many years.
WhiteArmor alleges that the compromised account belonged to Metawin and had never undergone credential rotation, thereby granting attackers persistent access to internal control panels and sensitive data stores. The group asserts this account was issued years prior yet remained active, enabling them to traverse systems normally restricted to administrators.
Regarding the scope of the alleged breach, WhiteArmor claims the stolen database holds more than 15.42 million accounts alongside 146 columns of information, though a complete public breakdown of specific data fields has not been provided. The attackers further stated that combined profit values associated with these accounts exceeded $1 billion, without offering an explanation for how that figure was calculated or defining the period it covers.
To substantiate their claims, the group released a downloadable JSON file purportedly containing 100 Gamdom accounts, with the provided sample weighing in at approximately 437 KB. The extortion message demands $15 million in Bitcoin and indicates that payment instructions will be sent directly to the company via email. Gamdom founder Felix Romer has challenged the severity of the alleged compromise, asserting that the attackers failed to extract the platform's complete database.
Romer states that the incident involved limited access affecting only a few hundred accounts, and notes that the company shut down its servers following the earlier attack to safeguard customer information. WhiteArmor is identified as a relatively new cyber extortion operation that first appeared on cybersecurity monitoring platforms in October 2026.
Threat intelligence records from HackerFeeds indicate that WhiteArmor first appeared in tracked victim listings on October 21, which was five days prior to the publication of the ransom demand against Gamdom. The operation has positioned itself as a data theft group and is reportedly recruiting hackers and security specialists through an affiliate program.
WhiteArmor's advertised arrangement permits participating attackers to retain 95% of successful ransom payments, with the remaining 5% allocated to the group. While WhiteArmor has claimed responsibility for breaches involving other businesses such as Whirlpool, J.B. Hunt, and LoveSac, these listings do not establish that those alleged intrusions were successful.
Following a breach linked to Gamdom's cryptocurrency hot wallet on October 13, the company suffered the loss of multiple million dollars in digital assets. Founder Felix Romer indicated that early losses surpassed $3 million, while blockchain analysts estimated the total stolen amount could reach approximately $4.2 million.
Hot wallets are linked to the internet to handle transactions, making them suitable for withdrawals and standard operations but subject to distinct security risks compared to offline storage. The prior incident drew the attention of blockchain investigator ZachXBT, who later identified funds connected to the Gamdom exploit while reviewing suspected cryptocurrency laundering activity.
Dispute Over Extent of Breach
The report previously noted that an inquiry dated October 20 connected the misappropriated assets to FreedomXMR, a digital currency platform running on Hyperliquid Core. ZachXBT determined that over 87 percent of the inflows to this service stemmed from questionable sources, such as ransomware payouts, system breaches, malicious software, and deception tactics. This review came after blockchain expert ZachXBT drew focus to money tied to the Gamdom breach while scrutinizing potential money laundering efforts.
The probe followed more than $20 million in movements linked to specific events, notably the Gamdom incident and assaults on DCENT Wallet, Fetch.ai, and Axelar. The analyst reviewed past transfers surpassing $10,000 and located over 3,000 deposits entering the exchange related to its functions. These results pertain to a prior matter that garnered notice from blockchain investigator ZachXBT, who later pinpointed funds connected to the Gamdom case.