Online poker cheating scheme may have cost high-stakes players up to $4 million

High-stakes online poker players may have lost as much as $4 million to a cheater who secretly viewed opponents’ hole cards, according to an investigation reported by WIRED.

The attacker allegedly compromised Jurojin and IntuitiveTables, two programs popular with professionals who play multiple online poker tables at once. The compromised software was able to install MeshAgent, a remote-access program capable of viewing and controlling infected computers. This gave the attacker access to opponents’ cards as they played, without breaching the poker sites’ own systems. WIRED reports that the compromised software may have reached more than 1,000 users.

A professional identified by WIRED under the pseudonym Alex discovered MeshAgent after an AI assistant flagged the program in September. He found evidence of 11 apparent screen-monitoring events while playing on Americas Cardroom (ACR). The same opponent, whose unusually high win-rate had already aroused suspicion, was present during 10 of those sessions. Alex estimates he lost about $30,000.

ACR’s operator, Winning Poker Network, says its integrity team examined more than two million hands involving players whose computers had been found to contain MeshAgent. That review included approximately 200,000 hands played by an account at the center of the allegations. The operator said it found no evidence that players had exploited knowledge of opponents’ hole cards in the hands reviewed. ACR told customers it would not issue refunds, although it closed the suspected player’s account after considering additional information from other operators. Alex’s apparent screen-monitoring records and the opponent’s win-rate have fueled questions among some players about whether cheating occurred on ACR.

CoinPoker told WIRED that it shared its findings about the suspected cheater with ACR but received no response. CoinPoker previously banned a suspected cheating account and refunded more than $100,000 to players. ClubWPT Gold also banned an account and reimbursed an affected customer.

Poker coach Patrick Howard says he warned GGPoker about suspicious results before the malware scheme became public in September. GGPoker subsequently introduced new measures to detect suspiciously high win rates, banned third-party poker software, and said it had traced suspected proceeds to a cryptocurrency wallet. The company asked Coinbase to restrict the associated account and preserve its records, and shared its findings with law enforcement.

ACR plans to activate its ScreenShield protection by default on November 4, limiting the ability of supported screen-capture and remote-viewing tools to display players’ cards.