Poker Hole-Card Malware Hack Raises Questions About Offshore Site Security

Published on November 4th, 2026

Illustration of a hacker viewing exposed hole cards on a laptop during an online poker game, representing the poker malware hack targeting high-stakes players.

Key Details

A hacker reportedly used malware to see opponents’ hole cards on ACR, CoinPoker, GGPoker and ClubWPT Gold, which Casino Reports describes as sweepstakes-style.
None of the four affected sites operate in the state-regulated US online poker market, according to Casino Reports.
WIRED’s sources estimate alleged losses on GGPoker and ACR at $1.5 million to $4 million.
ClubWPT Gold and CoinPoker refunded affected players, while ACR said it would not issue refunds.

A hacker allegedly used malware to see the hole cards of high-stakes poker players on Americas Cardroom (ACR), CoinPoker, GGPoker and ClubWPT Gold. None of these sites operate in the regulated US online poker market. Estimated losses on GGPoker and ACR alone range from $1.5 million to $4 million.

The attack raises questions about player security and protection. Unlike offshore and sweepstakes-style sites, state-regulated poker operators must answer to gaming regulators when something goes wrong. That doesn’t prevent cheating, but it gives players another layer of protection.

How the Hole-Card Malware Worked

The attack spread through two third-party poker tools, Jurojin and IntuitiveTables, which help players manage multiple tables. The hacker first compromised Jurojin’s update system. The malware then reached an IntuitiveTables developer’s computer, allowing the hacker to add malicious code to the software.

The malware, called MeshAgent, let the hacker view players’ screens and see their hole cards. More than 1,000 users may have received the infected software, but only certain players were targeted, mainly high-stakes regulars.

How a High-Stakes Pro Uncovered the Hack

On September 25, 2026, a professional poker player known as “Alex” was reviewing his poker stats using Claude AI. He discovered that malware had been installed on his computer back on April 24 without his knowledge. Records showed that someone had accessed his screen 11 times, all while he was playing on ACR.

The same opponent, using the name OxOO, was at his table during 10 of those 11 sessions. Alex estimates he lost around $30,000 during the affected games. Cybersecurity researcher WolfSec exposed the attack on X on September 29, although the hacker reportedly remained active on GGPoker and ACR until late September.

Licensed, Offshore and Sweepstakes Poker Are Different Markets

None of the four poker sites involved are licensed by US state gaming regulators. Offshore sites like ACR and sweepstakes-style platforms like ClubWPT Gold operate outside the regulated US market, meaning players don’t have the same state-level protections.

Our guide to the risks and benefits of offshore poker sites explains what players should know. You can also read our Americas Cardroom review for a closer look at ACR.

How Each Site Responded to Affected Players

ClubWPT Gold investigated the cheating, banned the account involved and refunded affected players. CoinPoker also banned the suspected cheater and refunded more than $100,000 to players.

GGPoker faced criticism for how it handled the situation. Poker player Patrick Howard reported suspected cheating in early September 2026 but said he didn’t receive a response until the attack became public. The suspected account reportedly remained active despite earlier complaints.

On October 15, GGPoker announced new security measures, including restrictions on third-party tools and improved cheating detection. The operator also traced funds linked to the suspected cheater to a Coinbase account.

ACR took a different approach. In an October 18 email, the site said its investigation found no evidence that game results had been affected and confirmed that players would not receive refunds. ACR also introduced a feature designed to stop remote-viewing software from capturing players’ hole cards.

Does State Regulation Offer Better Player Protection?

Six US states currently offer regulated real-money online poker: Nevada, New Jersey, Delaware, Pennsylvania, Michigan and West Virginia.

State regulation gives players an extra layer of protection. Licensed poker sites must follow gaming rules, and regulators can investigate complaints, issue fines or take action against operators that break those rules.

Offshore sites don’t offer the same state-level protections. ACR’s decision not to refund affected players shows why this matters. While regulation can’t prevent every cheating incident, it gives players another way to raise concerns when something goes wrong. For more information, check out our guide to the safest online poker sites.

What Poker Players Can Learn From This Hack

The attack shows why players should be careful with third-party poker software and pay attention to how sites handle cheating complaints. Licensed US poker sites aren’t immune to security risks, but state oversight gives players another way to seek help when something goes wrong.

For players looking to enjoy poker without risking their own money on entry fees, our free poker tournaments guide covers freerolls and how to get started.

Sandra is a content writer and editor specializing in online poker and iGaming. She covers poker sites, game formats, industry news, and US online poker laws for Legal US Poker Sites.