Duel refuses to freeze $426,500 in ETH tied to the ongoing Coldcard wallet hack

Coldcard hardware wallets, made by Coinkite, have been hit by a sustained wave of thefts that Galaxy Digital now puts at roughly 1,600 BTC — around $101.8 million confirmed stolen — with the total potentially reaching 2,000 BTC ($130.5 million) if a suspected fourth wave materializes. At least 15 separate attackers appear to be exploiting the same underlying flaw, according to outside reporting, across thousands of compromised addresses. Galaxy says it’s working directly with US federal law enforcement, crypto exchanges, and independent incident responders, passing along confirmed attacker wallets as it identifies them, and is urging anyone still running a vulnerable Coldcard to move funds immediately.

Galaxy hasn’t said how much of that roughly $130 million sits behind wallets it has already flagged to individual platforms, which makes the Duel dispute one of the first public tests of how an exchange or casino responds once a request arrives with transaction-level evidence attached rather than a bare allegation.

Alex Thorn, who heads research at Galaxy Digital, says his team gave Duel data connecting specific addresses and transactions to the Coldcard incident and expected the casino to act on it. Duel didn’t.

The casino’s public reasoning: an outside party’s claim alone isn’t proof, and a platform that freezes any balance on request opens itself up to abuse by anyone willing to make a false accusation. Duel says it normally waits for law enforcement or a court before restricting a user’s funds.

It did leave a narrower path open — if the person who actually lost the money comes forward, verifies they control the source address, puts it in writing, and can show the transaction trail leading into Duel, the casino says it will act. That puts the investigative burden on the victim rather than the platform, which is a defensible policy in isolation but a much harder bar to clear when funds have already been routed through a chain-hopping trail built specifically to break that kind of trace.