Hacker Behind Massive Curaçao Leak Could Expose Who Really Owns Hundreds of Offshore Online Casinos

A cyberattack disclosed last week by the Curaçao Gaming Authority (CGA) was carried out by a self-proclaimed “white hat” hacker who previously breached the Malta Gaming Authority’s (MGA) systems. German hacker and cybersecurity researcher Lilith Wittmann says she and collaborators spent nine months inside the Curaçao Gaming Authority’s systems. (Image: Lilith Wittmann/X) Berlin-based Lilith Wittmann, 30, said on social media Tuesday (September 22) that she and her collaborators gained access to internal CGA systems for nine months and “watched [the regulator] live at work.” “Without the employees knowing about it, I could see who owns illegal online casinos, who finances them, and what the authority knew about their operations,” she wrote on X. Wittmann’s CGA hack has already raised questions about the ownership structures of 1xBet and Stake, detailed Tuesday in a report by Dutch investigative website Follow the Money (FTM)—and Wittmann is teasing further revelations. These include an alleged €250 million tax loophole connected to Platin Casino, which Wittmann describes as “Germany’s largest illegal casino,” along with claims that leaked documents show software provider SoftSwiss is closely connected to companies operating hundreds of illegal casinos. Curaçao’s ‘Light Touch’ Legacy The tiny Caribbean island of Curaçao has licensed online casinos since the dawn of the industry, operating a notoriously “light touch” approach to regulation. The model attracted numerous operators serving markets where they were not locally licensed, while ownership was often obscured behind Curaçao companies and trust offices. Under pressure from the Netherlands, Curaçao has ostensibly abolished the old system—an unusual sub-licensing model that allowed a small number of private companies to extend their master licenses to large numbers of operators. But the leaked documents raise questions about the rigor of that transformation, showing that CGA officials approved licenses even after their own assessments identified unresolved questions about ownership and other potential red flags, according to FTM. The files include license applications, regulatory assessments, passports, tax returns, and financial information. FTM said the leak helped identify around 800 owners of nearly 650 licensed gambling companies operating thousands of gambling websites. Wittmann gained access to the CGA portal by registering under the name of a trust-office manager already known to the regulator while using her own Gmail address. She claimed to represent “DreamCatcher Private Foundation,” a fictitious company she created for the attempted license application. Within days, she was granted access to the regulator’s portal. Wittmann then uploaded software that enabled her to take control of the licensing system and access the information stored there, FTM reported. Stake Ownership Questions Initial leaks focus on the ownership of Stake and 1xBet. Stake founders Ed Craven and Bijan Tehrani are among the best-known figures in cryptocurrency gambling. But FTM reported that Stake’s Curaçao-based company, Medium Rare NV, is officially owned by Serbian national Mladen Vuckovic, who is publicly known as the company’s CEO. Vuckovic declared assets exceeding $1 billion in information submitted to the regulator in 2024. However, CGA officials themselves questioned whether Vuckovic was really the sole owner, according to FTM. They identified loans and payments worth tens or even hundreds of millions of dollars from Medium Rare to companies and individuals connected to Craven and Tehrani, neither of whom was named in the license application. 1xBet Ownership Questions The documents reveal similar uncertainty surrounding 1xBet. The offshore gambling giant has publicly been associated with Russian founders Roman Semiokhin, Dmitry Kazorin, and Sergey Karshkov, who died in 2023. But Ukrainian national Ihor Hniedash is listed as the owner and CEO of Caecus NV, the Curaçao company behind 1xBet. CGA assessors suspected 1xBet had “multiple owners” and requested information about Hniedash’s relationship with the Russians associated with the company, according to FTM. Nevertheless, the regulator granted Caecus a license in 2024 without receiving those answers, FTM reported. The CGA told the outlet it did not immediately reject companies whenever questions or uncertainties arose because Curaçao’s gambling industry was transitioning to a new regulatory regime. Wittmann said she released the documents because she believed there was a public interest in revealing who controls Curaçao’s gambling companies. The CGA acknowledged the unauthorized access on September 17, saying it had contained the breach and identified its source. The regulator said a forensic investigation remained underway and that it had not yet established the full scope of the incident. Malta Regulator Hack Wittmann is currently embroiled in litigation with the Malta Gaming Authority, which obtained a preliminary injunction against her in Germany after she gained unauthorized access to one of its systems earlier this year. The dispute also concerns statements by Wittmann about alleged links between the regulator and organized crime, allegations the MGA has rejected as unsubstantiated. The post Hacker Behind Massive Curaçao Leak Could Expose Who Really Owns Hundreds of Offshore Online Casinos appeared first on Casino.org.