Poker Cheat Exposed High-Stakes Players Hole Cards in Alleged $4M Scheme

High-stakes online poker players may have lost as much as $4 million to a cheater who allegedly watched their hole cards in real time, a WIRED investigation has found. The access came through tampered versions of Jurojin and IntuitiveTables, two tools widely used by professionals who play many tables at once.

According to WIRED, the compromised software quietly installed MeshAgent, a remote-access program that lets whoever controls it see and operate the infected computer. The attacker read cards straight off victims' screens, and none of the poker sites' own systems were breached, WIRED reported.

The malicious functions switched on selectively and were aimed at high-stakes players, according to WIRED, which said the software may have reached more than 1,000 users.

The weak point was software players chose to install, not any operator's servers. That has left the response to individual sites, and players hit by the same alleged scheme are being treated differently depending on where they played.

A pro's logs on Americas Cardroom

WIRED's account centers on a professional player it calls Alex, a pseudonym. An AI assistant flagged MeshAgent on his machine in September. He then found 11 apparent screen-monitoring events on Americas Cardroom (ACR), and the same opponent sat in 10 of those sessions.

That opponent's win rate was already high enough to look suspicious, according to WIRED. Alex puts his own losses at about $30,000.

ACR finds no evidence and pays nothing

ACR is run by Winning Poker Network (WPN). WPN said its integrity team reviewed more than 2 million hands involving players who had MeshAgent on their computers, around 200,000 of them from the account at the center of the allegations. It found no evidence that anyone exploited knowledge of hole cards in those hands.

ACR has told customers it will not issue refunds. According to reports, it closed the suspected player's account after other operators supplied further information. CoinPoker said it had shared its findings on the suspected cheater with ACR and got no reply, WIRED reported.

In our reading, WPN's conclusion sits uneasily beside Alex's records. A clean review is hard to square with one opponent present at 10 of 11 monitored sessions, and it leaves ACR's players with no claim to compensation.

Bans, refunds and a crypto trail elsewhere

Other sites went further. CoinPoker had already banned a suspected cheating account and refunded more than $100,000 to players, according to reports. ClubWPT Gold banned an account and reimbursed an affected customer, reports say.

GGPoker said it traced suspected proceeds to a cryptocurrency wallet. According to reports, it asked Coinbase to restrict a linked account and preserve its records, passed its findings to law enforcement, banned third-party poker software and added detection for unusually high win rates.

Poker coach Patrick Howard says he warned GGPoker about suspicious results before the scheme became public in September.

ScreenShield goes live November 4

ACR plans to switch on ScreenShield by default on November 4, according to reports. The feature stops supported screen-capture and remote-viewing tools from displaying cards, which targets the method used in this scheme.

The attacker has not been publicly identified. It is not known whether police have opened a case or whether Coinbase acted on GGPoker's request.