WhiteArmor Demands $15M Ransom Over Alleged Gamdom Database Breach

The extortion group WhiteArmor listed crypto casino Gamdom on its leak site on Oct. 26, 2026, and demanded $15 million in Bitcoin. The group claims it holds Gamdom's full user database.

The listing puts the database at 15.4 million accounts across 146 data columns. WhiteArmor posted a file it says holds 100 of those accounts as proof. Dark Web Informer, the threat-tracking account that flagged the listing, said no one has verified the file or the wider claim.

WhiteArmor Says an Old Admin Account Let It In

The group says it entered through an internal machine account with administrative access. According to the listing, someone issued that account years ago and nobody rotated its credentials. WhiteArmor says the account reached Gamdom's control panels and stored secrets.

The listing also attacks Gamdom's provably fair games, saying "what it promised and what it delivered were never the same thing."

The group published no evidence for that line. Gamdom hasn't confirmed or denied the leak.

The Claim Follows a $3 Million Wallet Breach

Gamdom took its site offline after an Oct. 13 breach of its hot wallets. Founder Felix Romer put the loss at just over $3 million, while on-chain analyst vxdb counted about $4.2 million. The casino came back on Oct. 16 and said player funds were safe.

WhiteArmor's listing cites that wallet breach. It does not say the two incidents share a cause.

The tracker ransomware.live describes WhiteArmor as an emerging group that has claimed at least five recent victims in the United States, Argentina, China and Germany. The listing says WhiteArmor will email payment instructions to Gamdom but did not set a public deadline.

Treat gambling as entertainment you pay for. 18+, and if it stops feeling like entertainment, help exists at BeGambleAware and GamCare.