button in SafariSuperuser Scandal: Poker Sites Were Warned About Suspicious Account
New reporting in the online poker superuser scandal says that two online poker sites were previously alerted about a suspicious account that one high-stakes player believes cheated him out of six figures.
Earlier this week, X user and cybersecurity expert @wolfsec0x0 exposed an online poker scandal going back two years involving attackers using third-party software to gain access to an online poker player's screen. In doing so, hole cards were exposed to the attacker.
One of the accounts in the attack, which allegedly targeted around 30 high-stakes poker players, was a mysterious user "Paul Gregg." According to Poker Red, two sites were warned about the Paul Gregg account, leading one of the sites to ban the account, confiscate $100,000 and refund cheated players.
Superuser on Multiple Poker Sites
Poker Red has reported extensively on the scandal, including speaking with poker pro Ignacio Moron, a victim of the Paul Gregg account who estimates he lost between $100,000 and $200,000 to the superuser and got taken for $60,000 in 15 minutes.
The Spanish poker outlet further reported that poker coach Patrick Howard of Mobius Poker submitted a report to GGPoker in September warning about suspicious behavior from the Paul Gregg account.
Howard, who has said the scandal "will change online poker forever," did not outright accuse the account of cheating and asked for further investigation from GGPoker. Howard wrote on X on Friday that GGPoker had reached out about the investigation.
A different poker site learned about the superuser account more than two years ago and promptly took action. High-stakes player Mario Mosbock, an ambassador for the unregulated site, confirmed that its security team detected the superuser account and confiscated $100,000 before banning the account.
Patrick Leonard, also a site ambassador, wrote on X that they caught the account "around 1 year ago after he had played less than a week on the site," noting that "we didn’t know exactly what he was doing, but it was obvious he had more information than other players."
The prominent online pro also said that a group of around 100 poker players voiced their suspicions about the Paul Gregg account to poker sites years ago but "he somehow was allowed to continue playing on those sites, winning and withdrawing at win rates that were likely not possible and showdowns that didn’t make sense."
"The future of online poker is in the hands of the sites and how much they are willing to investigate and act on bots & standalone characters like this," Leonard wrote on Friday.
It isn't yet clear how many sites were affected by software breach, which was apparently a targeted attack effecting a few dozen players.
Jurojin Poker, one of two compromised software products, released a statement earlier this week explaining the situation and actions being taken to prevent future compromise.
"This was a highly targeted operation, not a mass attack," the statement said. "It was carried out by a known cheater aiming at specific opponents, mostly at high stakes, with the goal of viewing their hole cards remotely. Jurojin was one of several applications targeted by the same actor, including IntuitiveTables. The same actor also operated phishing sites impersonating poker rooms and well-known poker tools."
There have been major superuser scandals in poker over the years. The most notorious superuser of them all is Russ Hamilton, who used his "POTRIPPER" account to cheat Absolute Poker and Ultimate Bet players out of millions in the late 2000s.
