Online Poker Cheating Scandal Hits Top Sites

An account playing under the name Paul Gregg sits at the centre of the worst security story online poker has faced in years. Players who sat against it across several sites report losses running into six figures, and investigators have since linked the account to malware that handed an outsider a live view of opponents’ computers. The cheating scandal that followed has pulled in two software makers, several of the biggest rooms in online poker and an independent cybersecurity researcher. Nobody has been charged, and the person behind the account remains unidentified.

Players Warned Online Poker Sites Before the Cheating Scandal Broke

Hole cards are the two cards dealt face down to each player, and they decide almost everything at the table. Anyone who can see an opponent’s hole cards knows exactly when to fold, when to call and when to push all in. That edge is unbeatable, and it is the reason this kind of cheating does more damage to online poker than any other form of fraud.

Patrick Howard, a poker coach who works with high-stakes players, noticed the pattern first. He sent GGPoker, one of the largest online poker rooms in the world, an analysis in September that laid out strange behaviour tied to the account. He asked the operator to review the activity without accusing the holder of cheating outright, and GGPoker later confirmed it had been in contact with him about its own investigation. That exchange gives the cheating scandal its earliest public marker in online poker.

CoinPoker, a crypto-based poker site, moved earlier and harder. The room flagged suspicious activity, deleted the account and seized more than $100,000, then reimbursed the players who had sat in those games. Patrick Leonard, a British professional who serves as a CoinPoker ambassador, said the account had been on the platform for less than a week before staff caught it.

Malware Hidden in Poker Software Updates

Serious online players rarely use the poker client on its own. They run third-party tools alongside it, software that stacks tables on screen, assigns hotkeys and automates parts of playing 12 tables at once. Those tools are the attack surface nobody was watching, and the cheating scandal now running through online poker began right there.

Jurojin Poker, one of the best known of them, confirmed its product was compromised. Altered updates reached some users between June 2025 and January 2026, meaning the malware arrived through the same channel players trust for bug fixes. Reports also name IntuitiveTables, a rival table manager, as affected.

Behind the compromise sat MeshCentral, a legitimate remote-access system that IT departments use around the world to support computers from a distance. Once installed, it gave the attacker a live view of the player’s screen and control of the machine. During a hand, that means hole cards, bet sizing and everything else on the monitor.

WolfSec0x0, the cybersecurity researcher who published the investigation, counted 10 to 30 computers across several regions that the operation may have reached. Jurojin called the targeting narrow rather than broad. The attacker went after particular high-stakes players and had hit poker-related services before, which separates this cheating scandal from the random credential theft online poker deals with every month.

One Player Puts His Losses in Six Figures

Ignacio Morón, a Spanish professional who plays high-stakes cash games online, estimates he lost between $100,000 and $200,000 to the account. Roughly $60,000 of that went in a single 15-minute stretch. Leonard has also said a much larger group of players complained about the same identity to various operators in previous years. Those complaints went nowhere public, which is why the cheating scandal reached online poker’s front pages only after a researcher published the technical evidence.

Getting the money back is another matter. CoinPoker could reimburse because it caught the activity on its own platform and still held the funds. Losses spread over other sites and other months sit in a much greyer area, since confirming which hands the attacker touched takes cooperation between rooms, software vendors and the players involved.

ACR Poker Tightens Table Security

ACR Poker, the flagship room of the Winning Poker Network, has already shipped a countermeasure. The site now blocks screen-sharing and screen-capture software from displaying its tables, which kills the simplest version of the attack. Streamers and coaches will feel the change, but the trade-off looks easy to justify given what this cheating scandal revealed about remote access inside online poker.

Other operators face the same question. Security teams can harden their own clients, yet the vulnerable surface sits outside their control, on home computers running third-party software built by small independent developers. Treating those tools as part of the security perimeter is the obvious next step for online poker, and this cheating scandal is the bill arriving for years of nobody owning the problem.

Echoes of Absolute Poker and UltimateBet

Poker has been here before, twice, and both times the damage lasted. In 2007, an account known as Potripper won impossible pots on Absolute Poker, and investigators traced the wins to a superuser account that could see every player’s hidden cards. A near-identical scheme surfaced at UltimateBet soon after, linked to former World Series of Poker champion Russ Hamilton, with losses estimated in the tens of millions.

Those cases grew from inside the operators themselves, through back doors built into their own software. This time the hole sits on the other side of the connection. The current cheating scandal in online poker began on players’ own computers, through tools they chose to install and updates they had no reason to question.

Nothing here is close to resolved. Investigations continue, prosecutors have filed no charges, and nobody has publicly identified who ran the account. What the community does know is that players flagged this cheating scandal in pieces for months before anyone in online poker joined those pieces up. The gap between the first complaint and the first real action is exactly where the damage piled up.