Dear Kucoin,
We are NOT a hacktivist group. We focus mainly on data extortion & ransomware, so please fuck off with your hacktivist bullshit.
https://www.kucoin.com/news/flash/hacktivist-group-whitearmor-claims-to-steal-15-42-million-gamdom-accounts-demands-15m-in-bitcoin
wagyu.xyz
Wagyu.xyz is a cross-chain swap platform that allows users to exchange cryptocurrencies for native Monero (XMR) without requiring identity verification (KYC) . It routes orders through Hyperliquid's order book for execution .
We hold 38,628 orders and 10,139 IPs from wagyu.xyz: wallets, sessions, fingerprints, countries, $907M XMR-heavy volume.
Our demand is only $5,000,000... hehe
Samples can be found below.
Since you do not have any emails for us to contact, surely you will contact us yourselves.
Contact Us:
Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67
Email: whitearmorrxd@proton.me
gamblinglore
Verification for Gamblinglore.com
Gamdom
Gamdom is an unregulated crypto casino and sportsbook founded in 2016. It recently suffered a hot-wallet breach, with founder Felix Romer reporting over $3 million in losses, though on-chain analysts estimate the damage closer to $4.2 million.
We hold Gamdom's full user database, 15,420,003 accounts with 146 columns, with Gamdom's total combined profit value exceeding $1 billion.
The way in was something internal, a machine account that was already sitting in their admin side (Metawin).
Issued years back, nobody ever rotated it. Never meant to leave the building.
It had admin reach, and everything after that was their own stuff anyway, their control panels and secret stores.
About your provably fair: what it promised and what it delivered were never the same thing.
We demand $15,000,000 in BTC.
Emails with instructions will be sent to you directly.
To verify, a sample can be found below.
LoveSac
LoveSac (LOVE) is a premium furniture retailer operating more than 250 showrooms across the United States, generating approximately $700 million in annual revenue.
We have obtained a database containing 1,113,285 order records spanning nearly seven years of transactions, from December 2019 through October 2026, with a combined recorded transaction value exceeding $1.62 billion.
Each record contains detailed customer and transaction information, including full customer names, complete billing and shipping addresses, telephone numbers, order numbers, order dates, order statuses, and order grand totals.
Our demand: $500,000 in BTC or XMR
To verify, samples can be found below.
WhiteArmor.cc
Hi, our VPS provider has decided to ban our account. Due to this, whitearmor.cc is down and so is most of the data posted on our DLS.
Everything will be back up within a day or two. One tip, do NOT use https://stealthvm.net/ XD
J.B Hunt
You are so stupid JB Hunt. Instead of getting in contact with us & starting the negotiation process, not only did you not announce the breach, you silently email customers demanding them to update their passwords..
Fuck you... ;/
https://x.com/WhiteArmorxd
Hi, we now have an X account.
https://x.com/WhiteArmorxd
Also, fuck the AI slop cti reporters lol
Partido Liberal
Brazil's Liberal Party (PL) is the political party of the Bolsonaro family. Although named "Liberal," it is currently characterized by conservatism and right-wing populism. Jair Bolsonaro joined the party in 2021, and his son Flávio Bolsonaro is now the party's presidential candidate, advocating reduced government intervention and tough security policies.
We hold the complete Partido Liberal (PL, Brazil) dump: 79K member records with CPF/voter ID/RG photos, 374 live cleartext e-Título credentials, 475 operator accounts with shared password, 2.7M audit events, party dossiers (artist payments, deepfakes, ghost donations), vendor PII, and 340K+ member images.
If you don't want this getting out, we suggest you contact us & pay the ransom amount of $5,000,000 in BTC :)
Contact:
Email: whitearmorrxd@proton.me
Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67
Hisense
Hisense is a Chinese multinational electronics and appliance manufacturer, founded in 1969, known globally for televisions and home appliances.
We hold Hisense's entire GCRM production document store, the full warranty-claims archive for Malaysia/Singapore: customer names, phones, emails, ID numbers, 2,549 suppliers, hundreds of invoices, payments, contracts, RMA forms, claim evidence, plus their internal CRM app binary.
Our demand is $500,000 in BTC. Good luck.
Contact: whitearmorrxd@proton.me
Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67
whitearmor.cc
Hi!
We now have a clearnet domain for easy-access.
WhiteArmor.cc
JB Hunt
J.B. Hunt is a major North American transportation and logistics company providing intermodal, dedicated, and truckload services via its digital freight marketplace.
We hold 140,838 employee records with PII and national IDs, 1.7M carrier contacts, 38.2M invoices, 187K RBAC permission records, 3,196 ranked account-takeover targets, 973 M365 mailboxes, 374K organizations.
Our demand: $5,000,000, in BTC or XMR. Instructions to follow by email.
To verify, samples can be found below.
Contact:
Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67
Email: whitearmorrxd@proton.me
Whirlpool
Whirlpool is a global home appliance manufacturer (NYSE: WHR) making washers, fridges, and cooking appliances under brands like KitchenAid and Maytag. Its 2025 annual revenue was about $15.52 billion.
We hold 4,577 Whirlpool employee records across three plants, names, AD-style usernames, managers, cost centers, shifts, along with 374 corporate emails, ~22,000 SAP invoice records, and the full plant contact infrastructure. Pay, and this stays quiet. Don't, and the data goes public.
We want $140,000 in BTC or XMR. You will receive an email containing instructions on how to proceed.
Samples:
https://biteblob.com/Information/mNTP6w0lBW8P9l/#samples.zip
Contact:
whitearmorrxd@proton.me
Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67
W.A
Hello,
We are WhiteArmor, an organization focused on data-theft extortion, with further motive to expand in to ransomware operations when considered big enough.
We are currently seeking the following people of roles and experiences:
Penetration testers
Web-exploitation
Zero-day research
A word due; if you are unfamiliar with the experiences slash roles listed above, do not consider attempting to join. Should you attempt to contact us and join, you will be blocked.
Our fee if you hit a successful ransom payout is 5%. The rest is yours.
Our contacts are available on our DLS below;
http://whitearz6uvtfdefgsc4r3mzmyswtte65k5umcmv6cu6zhi4l5k4irad.onion/
Updates.
Hi all; spots within the group are still open. If you're looking to join, you can find our contact information at the top right. Our ransomware is nearly complete, and we have multiple companies lined up to list, including Fortune 500 companies and multi-billion-dollar revenue firms.
To be clear, we're not just some random skid group. We are releasing Disney's Staff Directory as a little start to our group, though more to come. Anyways, enjoy.
This data is unrelated to the NullBulge leak; it was exfiltrated via a JWT authentication bypass vulnerability in the gateway.
