Duel Pays $37,000 Bug Bounty for Crash Game Payout Exploit

Crypto casino Duel paid a $37,000 bug bounty for a report describing a flaw in its Crash game. The bug let players collect winnings on bets that had already lost, the company said on Aug. 12.

Crash asks players to cash out of a climbing multiplier before it stops at a random point. Duel runs it as one of its in-house originals at 0% house edge, so a wrong payout comes straight out of the bankroll. The site holds about $7.5 million across its hot wallets, according to FairGambling's tracker.

Socket Messages Drive the Payout Flaw

The H1 user disclosed a serious exploit which allowed players to receive winnings on the Crash game mode after their bet had already lost.

That description came from Korra, an account that identifies itself as Duel's "scribe and herald," in a post on X. H1 is shorthand for HackerOne, the platform that brokers vulnerability reports between researchers and the companies they test.

Duel said the technique relied on "explicit socket events," the live messages a player's browser exchanges with a casino's servers, and that any abuse would have been visible on its side. The researcher was the first to find the flaw, the company said, so it incurred no losses.

Duel has not named the researcher, published the report, or given the bug a severity rating.

Award Runs Far Above Prevailing Bounty Rates

The sum is large by current standards. HackerOne cut the critical-severity award on its community-funded Internet Bug Bounty to $2,257 on May 18, 2026, from $9,250, The Register reported.

Duel's originals are provably fair, meaning players can check a round's result against published seeds. The flaw described sat downstream of that check, in what happened once a bet had already resolved.

Founder Ossi "Monarch" Ketola built the site around ending the house edge, a pitch FairGambling covered when he attacked rival operators in a July video.

Duel publishes privacy, KYC and responsible gaming policies on its site but no vulnerability disclosure program, and it has not said whether the HackerOne report will ever be made public.