A recent cyberattack revealed by the Curaçao Gaming Authority (CGA) was orchestrated by a self-proclaimed “white hat” hacker who had previously infiltrated the systems of the Malta Gaming Authority (MGA).
German hacker Lilith Wittmann, based in Berlin, revealed on social media that she and her team accessed CGA systems for a nine-month period, observing the regulator’s activities without detection.
Wittmann was able to uncover information about the ownership of illegal online casinos and their financial backers, shedding light on the authority’s knowledge of these operations through her infiltration.
Following the CGA hack, reports from Dutch investigative website Follow the Money (FTM) highlighted ownership structures of 1xBet and Stake, with Wittmann hinting at further disclosures to come.
These revelations include a reported €250 million tax loophole related to Platin Casino, described as Germany’s largest illegal casino, and leaked documents implicating software provider SoftSwiss in connections to numerous illegal casino operators.
Curaçao’s Regulatory Practices
The Caribbean island of Curaçao has been a long-standing hub for licensed online casinos, operating with a reputation for a lenient regulatory approach. Many operators flocked to the island for licensure, often concealing ownership behind local Curaçao entities and trust offices.
Under pressure from the Netherlands, Curaçao has purportedly revamped its regulatory system, moving away from a sub-licensing model that allowed a few private companies to extend master licenses to a multitude of operators.
Leaked documents, however, cast doubt on the thoroughness of this transformation, revealing instances where CGA officials granted licenses despite unresolved concerns about ownership and potential red flags.
The leaked files contain a wealth of confidential information, including license applications, regulatory assessments, passports, tax returns, and financial data, exposing approximately 800 owners of nearly 650 licensed gambling companies operating numerous gambling websites.
Wittmann managed to breach the CGA portal by posing as a trust office manager known to the regulator, using her own Gmail address. She set up a fictitious company, “DreamCatcher Private Foundation,” to apply for a license, gaining access to the regulator’s portal shortly after.
Through uploaded software, Wittmann was able to manipulate the licensing system and extract information stored within the portal, as per FTM’s report.
Ownership Inquiries for Stake
The initial leaks focused on probing the ownership of Stake and 1xBet.
Stake, founded by Ed Craven and Bijan Tehrani, renowned figures in cryptocurrency gambling, faced scrutiny as its Curaçao-based company, Medium Rare NV, was officially linked to Serbian national Mladen Vuckovic. Vuckovic, the public face of the company, declared assets over $1 billion in 2024, prompting doubts about sole ownership.
CGA officials raised concerns over loans and payments totaling millions of dollars from Medium Rare to entities associated with Craven and Tehrani, neither of whom were listed in the official license application.
Ownership Queries for 1xBet
Similar uncertainty surrounded the ownership of 1xBet based on the leaked documents.
The Russian founders of 1xBet, namely Roman Semiokhin, Dmitry Kazorin, and the late Sergey Karshkov, were publicly known figures. However, Ukrainian national Ihor Hniedash was listed as the owner and CEO of Caecus NV, the Curaçao entity tied to 1xBet.
CGA assessors suspected multiple owners behind 1xBet and sought clarity on Hniedash’s relationship with the Russian founders, unanswered at the time of granting the license in 2024, as reported by FTM.
The CGA explained they did not immediately reject companies amidst uncertainties due to the transition of Curaçao’s gambling industry to a new regulatory framework.
Wittmann’s decision to release the documents stemmed from a belief in the public interest to unveil the controllers of Curaçao’s gambling operations.
CGA acknowledged the security breach on September 17, assuring containment and identification of the source while conducting a forensic investigation to determine the breach’s extent.
Malta Gaming Authority Incident
Wittmann faces legal action from the Malta Gaming Authority, securing a preliminary injunction in Germany after her unauthorized access to their systems earlier this year.
The dispute involves Wittmann’s allegations of links between the regulator and organized crime, dismissed by the MGA as unfounded.