12:48 UTC
Stake is, by most measures, the largest crypto casino in the world, and on 4 September 2023 its Ethereum hot wallet did something hot wallets do fifty thousand times a day: it signed a transfer. This one sent about $3.9 million of USDT to an address nobody at the company controlled. Two more transfers followed within minutes, moving over 6,000 ETH — about $9.8 million at the time — and then a run of smaller ones emptying out the stablecoins and tokens that were left: USDC, DAI, and on two other chains, BNB and MATIC.
Analysts who watch the chains noticed before the casino announced anything. PeckShield’s first estimate, covering Ethereum alone, was $15.7 million; ZachXBT pointed out that the same actor had drained about $25.6 million more from Stake’s BNB Chain and Polygon wallets; Beosin’s reconciled total was $41.35 million. Etherscan labelled the receiving address “Stake.com Hacker” while the transfers were still landing.
| CHAIN | APPROX. LOSS |
|---|---|
| Ethereum (ETH, USDT, USDC, DAI) | $15.7 million |
| BNB Chain (BNB) | $17.8 million |
| Polygon (MATIC) | $7.8 million |
| Total | $41.35 million |
Bitcoin, Litecoin, XRP, EOS and TRON wallets were not affected. Figures are 4 September 2023 prices as reported by the tracing firms.
What was touched, and what was not
Stake’s first public post said unauthorised transactions had been made from its ETH and BSC hot wallets, that the wallets were being investigated, and that user funds were safe. Deposits and withdrawals on the three affected chains were paused; everything else kept running. At 21:28 UTC the company announced that all services had resumed — under nine hours after the first transfer, and a few hours after the public acknowledgement.
Co-founder Ed Craven described the attack as a sophisticated breach of a service the casino used to authorise transactions, and said private keys were not compromised — the attacker had been able to make “several unauthorised transactions” from the hot wallets rather than take the wallets themselves. Several security researchers disagreed in public: to them, a stranger signing valid transfers from your address is the definition of a key compromise, whatever the key was wrapped in. The dispute is less about facts than about vocabulary. A signing service holds, or can reach, the authority to spend; whoever controls the service controls the money, and for about ten minutes somebody else did.
- Not touched: the games. No seed was leaked, no result was altered, no bet was paid wrong. Every round played that day verifies today exactly as it did then.
- Not touched: the cold storage. The Bitcoin, Litecoin and XRP balances — the bulk of a casino’s float — sat elsewhere and never moved.
- Touched: the operational float. The money a casino keeps hot so that withdrawals clear in minutes. $41 million is a large hot balance; it is also a fraction of what a site of that size turns over in a day, which is why the casino could absorb it and pay withdrawals as if nothing had happened.
Days later, a name
Attribution came faster than it usually does. Within the week the FBI said its investigation had revealed that DPRK cyber actors — the Lazarus Group, which it also tracks as APT38 — had moved the stolen funds from Stake’s Ethereum, BNB Chain and Polygon wallets, and it published the addresses the group was using so that exchanges could refuse the money. The same bulletin put the group’s 2023 haul at more than $200 million: about $100 million from Atomic Wallet in June, $60 million from Alphapo and $37 million from CoinsPaid in July, and now Stake.
The laundering followed the pattern the group has used since the Ronin bridge theft a year earlier: funds bridged chain to chain, consolidated on Avalanche, swapped into wrapped bitcoin and then into native bitcoin, where tracing gets harder and the sanctioned mixers do the rest. None of the $41 million has been recovered, and none was expected to be. A casino that is hacked by a state does not get its money back; it gets a press release.
The FBI investigation has revealed that DPRK cyber actors moved stolen funds associated with the Ethereum, Binance Smart Chain and Polygon networks from Stake.com.FBI public service announcement, September 2023
Two promises, and only one of them is provable
Stake was one of the sites that made “provably fair” a standard, and its games were provably fair on 4 September 2023 in the morning, during the theft and after it. That is not irony; it is the lesson. A provably fair system makes one promise: the result of each round is fixed by a committed seed before you bet, and you can recompute it afterwards. What a hash commitment proves is exactly that and nothing more. It says nothing about who can spend the balance you won.
Custody is a second promise, made in a different language. It is a statement about keys, signing services, cold storage ratios and the people and software allowed to touch them — and none of it can be verified from the outside by a player, because a casino that published its signing architecture would be publishing a map for the next Lazarus. The best a site can do is behave well when it is tested, as Stake did: say what happened, keep paying, and not touch the one thing that was provable.
Betkyo publishes the derivation of every game and the verifier that recomputes every round. It does not publish how its wallets are keyed, where its float sits or what signs a withdrawal, and it will not, for the reason above. No casino’s custody is “provably” anything; treat claims to the contrary as marketing.
What a player can do is arithmetic, not cryptography. A balance left on any site is a loan to its hot wallet. Keep on the site what you intend to play, withdraw what you do not, and read what the withdraw window checks before it sends so that a pause looks like what it usually is — a check — rather than a theft. The seeds you can verify. The vault you can only size.
遊The part you can verifyEvery round recomputable from the committed seed — the promise provably fair actually makesDice →
FAQ
How much was stolen in the Stake hack?
About $41 million, per Beosin’s reconciliation: roughly $15.7 million on Ethereum, $17.8 million on BNB Chain and $7.8 million on Polygon, drained from hot wallets on 4 September 2023 starting at 12:48 UTC.
Who hacked Stake?
The FBI attributed the theft to the Lazarus Group (APT38), a North Korean state cyber unit, within days of the attack, and published the addresses the group used. The FBI linked the same group to more than $200 million of crypto thefts in 2023, including Atomic Wallet, Alphapo and CoinsPaid.
Were Stake users’ funds lost?
Stake said user funds were safe, paused deposits and withdrawals on the three affected chains, and reported all services restored at 21:28 UTC the same day. Bitcoin, Litecoin, XRP, EOS and TRON wallets were not affected. The loss was absorbed by the company.
Were the games or the provably fair system compromised?
No. The breach was of a service used to authorise hot-wallet transactions, not of the game engines or their seeds. Every round remained verifiable. Provably fair proves game results; it says nothing about custody of funds.
How can a player protect against a casino hack?
You cannot verify a casino’s custody from outside, so size your exposure instead: keep on the site what you intend to play, withdraw the rest, and understand the site’s withdrawal checks so a routine pause is not mistaken for a theft.
SOURCES & REFERENCES
- Cointelegraph — “Crypto casino Stake resumes services hours after hack” (4–5 September 2023): the 12:48 UTC first transfer, the ETH and USDT amounts, the 21:28 UTC restoration, Beosin/PeckShield/ZachXBT estimates
- DL News — “Stake co-founder says hacker did not compromise private keys” (September 2023): Ed Craven’s account of the transaction-authorisation service, the ~50,000 transactions a day figure, researchers’ disagreement
- SecurityWeek — “FBI Blames North Korean Hackers for $41 Million Stake.com Heist” (11 September 2023): the FBI attribution to Lazarus, the networks named, the 2023 thefts list
- Blockworks — “FBI blames North Korea’s Lazarus Group for $40M Stake hack”: the Avalanche bridge and wrapped-to-native bitcoin laundering path
THE GAMES IN THIS ARTICLE