High-stakes online poker players may have lost as much as $4 million to a cheater who secretly viewed opponents’ hole cards, according to a new investigation that has raised questions about at least one operator’s response to the issue.

The attacker allegedly compromised Jurojin and IntuitiveTables, two programs popular with professionals who play multiple online poker tables simultaneously.

The compromised software was able to install MeshAgent, a remote-access program capable of viewing and controlling infected computers. This gave the attacker access to opponents’ cards as they played, without breaching the poker sites’ own systems.

WIRED reports that compromised software may have reached more than 1,000 users, although the malicious functions were activated selectively against high-stakes players.

One of them, a professional identified by WIRED under the pseudonym Alex, discovered MeshAgent after an AI assistant flagged the program in September.

He found evidence of 11 apparent screen-monitoring events while playing on Americas Cardroom (ACR). The same opponent, whose extraordinarily high win-rate had already aroused suspicion, was present during 10 of those sessions. Alex estimates he lost about $30,000.

ACR Findings Challenged

ACR’s operator, Winning Poker Network, says its integrity team examined more than two million hands involving players whose computers had been found to contain MeshAgent, including approximately 200,000 hands played by an account at the center of the allegations.

It said it found no evidence that players had exploited knowledge of opponents’ hole cards in the hands reviewed. ACR subsequently told customers it would not issue refunds, although it closed the suspected player’s account after considering additional information from other operators.

Some players are skeptical. Alex’s apparent screen-monitoring records, together with the opponent’s unusually high win-rate, have fueled questions about whether cheating occurred on ACR.

How Other Poker Sites Responded

CoinPoker also told WIRED that it shared its findings about the suspected cheater with ACR but received no response.

CoinPoker previously banned a suspected cheating account and refunded more than $100,000 to players. ClubWPT Gold also banned an account and reimbursed an affected customer.

Meanwhile, poker coach Patrick Howard says he warned GGPoker about suspicious results before the malware scheme became public in September.

GGPoker subsequently introduced new measures to detect suspiciously high win rates, banned third-party poker software, and said it had traced suspected proceeds to a cryptocurrency wallet.

The company asked Coinbase to restrict the associated account and preserve its records, and shared its findings with law enforcement.

ACR plans to activate its ScreenShield protection by default on November 4, limiting the ability of supported screen-capture and remote-viewing tools to display players’ cards.