The last time online poker had a scandal like this, it nearly killed the game.
In the early 2000s, during the poker boom, players on UltimateBet were being swindled by someone with backend access to the client. A superuser, in other words: an account that could see every opponent’s hole cards in real time. He was eventually identified as Russ Hamilton, a former WSOP Main Event champion, and the figures he took from players went past $20 million. Poker was growing so rapidly that it somehow healed and kept climbing.
This week’s version has a different shape, and in one way a worse one. It’s a hammer blow to a brittle industry already teetering on the edge.
The accused is Paul Gregg, a Canadian who played mid to high stakes on GGPoker, CoinPoker and the Winning Poker Network sites including ACR. He has not responded publicly and faces no reported charges.
What investigators say happened is this: two third-party poker tools, Jurojin and IntuitiveTables, had their software updates tampered with, and both have now confirmed the compromise. The attacker swapped in Mesh Agent, a component of legitimate open-source IT software called MeshCentral, which is exactly why no antivirus flagged it. On an infected machine it gave a live view of the screen, control of the mouse and keyboard, and every hole card on it.
It’s normal for grinders to use these tools. I used Jurojin myself, for table management and extra bet sizing buttons. Around 30 high-stakes players are reported to have been hit between March 2024 and June 2026.
UltimateBet was an inside job, and the industry could tell itself that one rogue operator had been dealt with. This came through software thousands of players install voluntarily, and that nobody audits.
One of the accounts attributed to Gregg, JackKlompus, won $402,700 across 32,200 hands on WPN at a rate of 24 big blinds per 100 hands. His regular game was $25/$50, where you are playing some of the best players alive. At that level a genuinely elite winner might manage one to three. Five would be remarkable. In the biggest games he played, his rate was over 42.
Then there is a stretch of 140 hands at $0.25/$0.50, a stake he otherwise never touched, where he lost $374.70. That is roughly seven and a half full buy-ins in 140 hands. You cannot lose money that fast by accident. Players who have gone through the data say he was dumping at small stakes deliberately, to drag his overall win rate down to something that looked merely very good instead of impossible.
Here’s the part that should worry anyone who plays online. This isn’t news to everyone. CoinPoker caught him two years ago.
Their security team flagged an account playing as “Europe”, banned it, and confiscated more than $100,000, redistributing the money to the players it had beaten. Gregg complained to the gaming regulator, demanded the funds back and protested his innocence. CoinPoker built its case and prepared for a hearing. He dropped the claim. The ban stood.
That was two years ago. He kept playing everywhere else.
GGPoker and ACR had every hand he ever played sitting on their servers. Patrick Howard, who coaches as Mobius Poker, says he analyzed 32,780 hands after a friend’s unexplained losses and sent GGPoker a report setting out the patterns. He says nothing came of it.
Nacho Morón, the Spanish high roller who lost $60,000 to “Europe” in fifteen minutes and puts his total losses at up to $200,000, says the accounts were reported “more than 20 or 30 times” over two years while staying active. “I give full responsibility to the rooms,” he said. “It’s too much time.”
Then the line that lands hardest, from a man who was cleaned out by it: “The newest room at that time was CoinPoker, and the one that was supposed least prepared, and the first one to catch it.”
Poker grew its way out of UltimateBet. There was so much new money arriving that the industry could absorb a $20 million theft and keep climbing.
That money isn’t coming now. The games are smaller, the players are sharper, and the one thing still holding the whole thing together is the belief that somebody at the top is checking. For two years, nobody was.
Discussion about this post