Crypto casino security: lessons from the Stake hot wallet hack
In 2023 attackers took about $41m from Stake's hot wallets. What crypto casinos should learn about hot wallet limits, insider risk, approvals and automated checks.
By Andrew Lindley · · 3 min read
On 4 September 2023, crypto casino Stake lost around US$41m from its hot wallets on Ethereum and BNB Smart Chain. Within days the FBI attributed the theft to North Korea's Lazarus Group and published the addresses involved (SecurityWeek, Cointelegraph).
Stake survived and kept paying players. Many smaller operators would not. When I designed crypto treasury for a casino this year, this incident shaped how I thought about every control.
Hot wallets are the front door
A casino needs hot wallets to pay withdrawals quickly. That makes them the most exposed part of the business. The goal is not to make hot wallets impossible to attack. It is to make sure that when something goes wrong, the loss is small and contained.
Five controls every crypto casino should have
1. Keep hot wallets thin. Hold only what you need for a short period of withdrawals. Refill them from treasury automatically, within limits. A breach then costs hours of withdrawals, not the business.
2. Separate treasury completely. Treasury should only be able to send funds to your own whitelisted vaults. It should never be able to pay an external address directly.
3. No single point of control. No one person, and no single system, should be able to move large sums or change the rules alone. Policy changes and large transfers should need more than one approver.
4. Check every automated transaction twice. Automation is essential, but it must not approve everything blindly. An independent check against your own records — is this a real, approved player withdrawal? — catches compromised systems and insider fraud alike.
5. Limits and alerts. Per-transaction, daily and velocity limits stop a fast drain. Alerts on unusual patterns give people time to act.
Do not forget the inside threat
Outside attackers make headlines, but insider fraud is just as real. Controls that stop a hacker usually stop a dishonest employee too: segregation of duties, approvals, whitelists and full audit logs. Design for both from day one.
Plan for the bad day
Write down what happens if a hot wallet is compromised. Who freezes what? How do you keep paying players? Who talks to the regulator, the bank and the public? Test it before you need it.
Tools help, design decides
Custody platforms such as Fireblocks give you strong building blocks: MPC key management, policy rules, co-signers and automation. But the protection comes from how you set them up. I explain my approach in how to design casino treasury on Fireblocks.
If you want an independent review of your crypto treasury controls, get in touch or see my Fireblocks services.
Sources
Gambling industry business adviser. Holds a solicitor's practising certificate but does not give legal advice through this business. Co-founder of Lottoland and Lot.to, former CEO of Sportech plc and former General Counsel of the Tote. More about Andrew