{"investigation":{"slug":"metawin","entity_name":"Metawin","trust_score":56,"severity_base":56,"score_modifier":0,"confidence":1,"status":"published","content_type":"investigation","summary":"Metawin is an offshore crypto casino and gaming platform licensed under the Anjouan (Comoros) gaming authority, operated by Asobi N.V. from Curacao, and founded by Richard 'Skel' Skelhorn. On November 3, 2024, the platform suffered a significant hot wallet exploit across Ethereum and Solana blockchains resulting in approximately $4 million in stolen funds, with blockchain investigator ZachXBT tracing the stolen assets to KuCoin and a nested HitBTC service across more than 115 attacker-linked addresses. The CEO subsequently claimed to have personally covered the losses, restoring withdrawals for approximately 95% of affected users, though the platform's offshore jurisdictional status and the underlying security vulnerability raise ongoing concerns.","sections":[{"content":"Metawin is a crypto-native online casino and gaming platform offering prize competitions and gambling products denominated in cryptocurrency. The platform operates under gambling license ALSI-152312009-FI3 issued by the Anjouan Gaming Board (Autonomous Island of Anjouan, Comoros), with corporate operations run by Asobi N.V. from Willemstad, Curacao. The UK-registered entity MetaWin Limited (company number 15072116) lists Raman Dandyan, a Canadian national born in 1997, as beneficial owner with more than 75% ownership. The platform's public-facing CEO goes by the handle Richard 'Skel' Skelhorn. Reported offices include Monaco, Gibraltar, and Miami in addition to the Curacao registration.","heading":"Platform Overview","sources":[],"severity":"medium"},{"content":"On November 3, 2024, Metawin's hot wallets on the Ethereum and Solana blockchains were drained of approximately $4 million in cryptocurrency. CEO Richard Skelhorn publicly confirmed the breach, attributing it to a vulnerability in the platform's 'frictionless withdrawal system' — an architectural design intended to reduce friction for user withdrawals that inadvertently created exploitable security gaps. According to Skelhorn, the attacker leveraged this system to submit a high volume of consecutive withdrawal orders, bypassing security checks and draining the hot wallets before the anomaly was detected. The platform immediately suspended all withdrawals following discovery of the exploit. Blockchain investigator ZachXBT, working alongside the CEO, traced the stolen funds and identified over 115 wallet addresses associated with the attacker across Ethereum and Solana, a pattern consistent with organized cybercrime activity. The stolen assets were transferred to KuCoin and a nested service on HitBTC in an apparent attempt to obfuscate the transaction trail.","heading":"November 2024 Hot Wallet Hack","sources":[],"severity":"medium"},{"content":"Blockchain investigator ZachXBT conducted on-chain tracing of the stolen funds in collaboration with Metawin's CEO following the November 3, 2024 exploit. ZachXBT identified more than 115 distinct wallet addresses linked to the attacker across both the Ethereum and Solana blockchains, a distribution pattern he noted was consistent with an organized group or cybercrime organization rather than a lone actor. The stolen funds were found to have been routed to KuCoin and a nested service on HitBTC — exchange venues commonly used in laundering operations due to their liquidity and, in the case of nested services, reduced KYC visibility. ZachXBT published a report via Chainabuse documenting the attacker's Solana addresses. No confirmed attribution to a named threat actor or group was publicly announced at the time of reporting.","heading":"ZachXBT On-Chain Investigation","sources":[],"severity":"medium"},{"content":"Following the exploit, CEO Richard Skelhorn stated via the platform's Discord server that he would personally cover the approximately $4 million in losses, describing the action with the phrase 'I just emptied my piggy bank, we don't dwell on it.' The platform reported that approximately 95% of users had their withdrawal capabilities restored in the immediate aftermath. Skelhorn also stated that law enforcement had been engaged to investigate. No independent verification of the full repayment or the law enforcement engagement has been reported by Tier 1 or Tier 2 outlets. The remaining 5% of users whose withdrawals were not immediately restored were not publicly accounted for in available reporting.","heading":"User Fund Recovery","sources":[],"severity":"medium"},{"content":"Metawin operates under a gambling license from the Autonomous Island of Anjouan (Comoros), a jurisdiction not recognized by any major gambling regulatory authority or EU member state. The Anjouan license provides minimal consumer protections compared to licenses issued by the UK Gambling Commission, Malta Gaming Authority, or comparable regulators. Analysis by FinTelegram found that Metawin lacks any valid EU or EEA gambling license, meaning operation targeting EU residents is potentially unlawful under applicable national law in most EU jurisdictions. Metawin's own terms of service restrict players from Austria, France, Germany, the Netherlands, and Spain but permit access from Italy, Poland, Sweden, Romania, Portugal, and other EU member states, creating a compliance gap. The Anjouan jurisdiction is widely regarded in the industry as offering a low-oversight, low-cost licensing regime with limited enforcement capability.","heading":"Regulatory and Jurisdictional Concerns","sources":[],"severity":"medium"}],"timeline":[{"date":"2023","event":"MetaWin Limited registered in the UK (company number 15072116) with Raman Dandyan listed as beneficial owner (75%+). Exact incorporation date approximated from available records.","source":"","source_url":"https://fintelegram.com/metawin-metawin-bcgame-crypto-casino-regulation/","date_original":"2023-01-01"},{"date":"2024-11-03","event":"Metawin hot wallets on Ethereum and Solana blockchains exploited via the platform's frictionless withdrawal system. Approximately $4 million in cryptocurrency stolen. CEO Richard Skelhorn confirms the breach and suspends withdrawals.","source":"","source_url":"https://www.theblock.co/post/324251/crypto-casino-metawin-loses-4-million-to-exploit-of-ethereum-solana-hot-wallets"},{"date":"2024-11-03","event":"ZachXBT begins on-chain tracing in collaboration with Metawin CEO. Over 115 attacker-linked wallet addresses identified across Ethereum and Solana. Stolen funds traced to KuCoin and a nested HitBTC service.","source":"","source_url":"https://www.chainabuse.com/report/094193aa-aba7-4af8-b7e6-84f0a6b608db"},{"date":"2024-11-04","event":"CEO Richard Skelhorn states via Discord that he will personally cover the $4 million loss from his own funds. Platform reports 95% of users have had withdrawal capabilities restored. Law enforcement engagement announced.","source":"","source_url":"https://www.gamblingnews.com/news/metawin-hit-by-4m-cyber-heist-most-funds-recovered/"},{"date":"2024-11-04","event":"Multiple crypto news outlets (The Block, CoinDesk, Cryptopolitan, Brave New Coin) report on the exploit. ZachXBT's Chainabuse report on attacker Solana addresses published.","source":"","source_url":"https://bravenewcoin.com/insights/crypto-casino-platform-metawin-hacked"}],"sources_used":[],"source_tags":["etherscan","zachxbt"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet","created_at":"2026-05-04T16:04:57.445519+00:00","updated_at":"2026-10-10T18:48:36.442+00:00"},"source_quality":{"total":0,"tier1":0,"tier2":0,"tier3":0,"unrated":0},"follower_count":null,"content_updated_at":"2026-10-10T18:48:37.148Z","last_fact_checked_at":null,"fact_check_next_allowed_at":null,"update_next_allowed_at":null}