Poker Scandal: Sites Ignored Warnings About a Scammer

New details have emerged in a major online poker scandal: two platforms ignored warnings about a suspicious account that stole six-figure sums.

In recent days, the poker community has once again found itself at the center of a major scandal involving online cheating. A new investigation has revealed that two poker sites were warned in advance about a suspicious account, which, according to victims, used third-party software to gain access to opponents’ cards and stole six-figure sums from them. One of the key episodes involved a user with the nickname "Paul Gregg," who reportedly targeted around 30 high-stakes players. How the superuser operated: details of the scheme The scandal came to light thanks to posts by X-user and cybersecurity specialist @wolfsec0x0 . According to his information, the attacks took place over two years: the perpetrators used third-party programs to gain access to the player’s screen, allowing them to see hole cards in real time. This gave the cheaters a decisive advantage and turned them into so-called "superusers"—players with information unavailable to others. Among the victims was professional player Ignacio Moron (also known as Nacho Moron). He told Poker Red that he lost between $100,000 and $200,000 due to the actions of the Paul Gregg account. In one episode, Moron lost $60,000 in just 15 minutes playing against the superuser. Reaction of poker sites and the investigation Information about the suspicious account was brought to the attention of poker rooms long before the scandal became public. Well-known coach Patrick Howard (Mobius Poker) sent a report to GGPoker about strange activity on the Paul Gregg account back in September. In his message, he did not make direct accusations but insisted on a thorough investigation. Later, Howard noted that this case "will forever change online poker" and reported that GGPoker had contacted him regarding the investigation. On another poker site, whose name has not been disclosed, the suspicious account was identified more than two years ago. The site’s ambassador, high-stakes player Mario Mosbock , confirmed that the security team discovered the superuser, confiscated $100,000, and then blocked the account. Another ambassador for the same site, well-known online pro Patrick Leonard , said that the team caught the cheater about a year ago, shortly after he started playing on the site. "We didn’t know exactly how he was doing it, but it was obvious he had more information than other players," Leonard noted. According to him, several years ago about 100 professional players expressed suspicions about the Paul Gregg account, but he continued to play, win, and withdraw money at rates that seemed impossible, and his hands appeared illogical. Leonard emphasized: "The future of online poker depends on how willing the sites themselves are to investigate and stop the activities of bots and similar actors." Scale of the attack and software vulnerabilities It is still unclear how many poker rooms were affected by this scheme. It is known that the attack was targeted and affected several dozen players, mostly at high stakes. One of the compromised programs was Jurojin Poker . In an official statement, the developers said the attack was not widespread but rather a "high-precision" scam aimed at specific opponents to gain access to their hole cards. In addition to Jurojin, other applications were also affected, including IntuitiveTables . The perpetrator also created phishing sites disguised as poker rooms and popular poker tools. The Jurojin developers noted that they are taking measures to prevent similar incidents in the future and are cooperating with affected players and poker sites. Historical context: the biggest superuser scandals Cheating using superuser accounts is not new to the poker world. The most notorious case remains the scandal involving Russ Hamilton and his "POTRIPPER" account on Absolute Poker and Ultimate Bet in the late 2000s. At that time, player losses amounted to millions of dollars, and the reputation of online poker was seriously damaged. The current incident shows that despite technological advances, threats remain, and fraudsters continue to look for new ways to bypass security. Table of key participants and their roles Paul Gregg — suspected superuser, targeted about 30 high-stakes players, won and withdrew six-figure sums. Ignacio Moron (Nacho Moron) — professional player, victim of Paul Gregg’s actions, lost $100,000–$200,000, including $60,000 in 15 minutes. Patrick Howard — Mobius Poker coach, the first to officially report suspicious activity on the Paul Gregg account to GGPoker. Mario Mosbock — ambassador for one of the sites, confirmed that the security team identified the superuser, confiscated $100,000, and blocked the account. Patrick Leonard — online pro and ambassador, noted that a group of 100 players had long suspected the Paul Gregg account, but he continued to win on various sites. @wolfsec0x0 — cybersecurity expert who publicly revealed details of the scheme and initiated the investigation. Russ Hamilton — figure in the largest superuser scandal in poker history (Absolute Poker and Ultimate Bet, late 2000s). Reaction and actions of poker sites Two poker rooms received warnings about the suspicious account. One of them, according to Poker Red, after an internal investigation, blocked the Paul Gregg account, confiscated $100,000, and returned the funds to affected players. The second room (GGPoker) launched its own investigation after Patrick Howard’s report, but the results have not yet been made public. Poker sites and software developers, such as Jurojin Poker, have announced the implementation of additional security measures and cooperation with players to prevent similar attacks in the future. Nevertheless, the incident demonstrated that even large and well-known poker rooms can be vulnerable to targeted attacks. What this means for PPPoker club players This scandal clearly shows that even experienced players and major sites can fall victim to targeted attacks using third-party software. For PPPoker club members, this is an important signal: special attention must be paid to security—do not install suspicious programs, avoid phishing sites, and regularly update your devices and poker applications. Players should remember that security in online poker is not only the responsibility of the rooms, but also a personal responsibility. Use only official applications, do not click on suspicious links, and do not share your data with third parties. If you notice suspicious activity or strange hands, do not hesitate to contact the club or room’s support service. For administrators and owners of PPPoker clubs, it is important to regularly inform members about possible threats, conduct internal checks, and maintain communication with developers for timely response to incidents. Only through joint efforts can risks be minimized and fair play ensured for everyone.