jili tutorial

Hacker Behind Massive Curaçao Leak Could Expose Who Really Owns Hundreds of Offshore Online Casinos

By jili tutorial · September 23, 2026

Hacker Behind Massive Curaçao Leak Could Expose Who Really Owns Hundreds of Offshore Online Casinos

A German cybersecurity researcher has pulled back the curtain on Curaçao’s online-gambling industry. For nine months, according to her own account, she and a small group of collaborators were silently present inside the Curaçao Gaming Authority’s computer systems. What they saw, she says, could change how the world understands the ownership of hundreds of offshore gambling websites.

Lilith Wittmann, a 30-year-old Berlin-based security researcher, has described her work as “white hat” hacking—an attempt to expose vulnerabilities in the public interest. The Curaçao Gaming Authority (CGA), which acknowledged the breach on September 17, calls it unauthorized access. Both things may be true.

A Nine-Month Digital Sting

Wittmann announced the intrusion on September 22 via social media. She wrote that she and her collaborators had spent nine months inside CGA systems and had “watched the regulator live at work.” In a post on X, she described the view from the inside:

“Without the employees knowing about it, I could see who owns illegal online casinos, who finances them, and what the authority knew about their operations.”

The breach was not a simple database theft. Wittmann claims her team had live access to the regulator’s portal, internal assessments, license applications, and other sensitive documents. They were not just looking at historical records; they were observing the CGA process in real time.

The CGA acknowledged the security incident last week and said it had contained the breach and identified its source. A forensic investigation was still underway at the time of writing, and the regulator said it had not yet established the full scope of the incident.

What Actually Leaked?

The leaked records reportedly include license applications, regulatory assessments, passports, tax returns, and financial information. That mix of documents has made the leak unusually valuable to journalists and regulators.

Dutch investigative outlet Follow the Money (FTM) analyzed the materials and reported that the leak helped identify around 800 owners of nearly 650 licensed gambling companies. Those companies collectively operate thousands of gambling websites. The scope gives the leak major implications not just for Curaçao, but for every market where those websites accept customers.

Stake: The Man on Paper vs. the Men in Practice

Stake is one of the most well-known crypto gambling brands in the world. Its public founders, Ed Craven and Bijan Tehrani, have become familiar faces in the industry. But the corporate records that matter in Curaçao tell a more complicated story.

The company behind Stake is Medium Rare NV. Its official Curaçao owner, according to the licensing documents, is Serbian national Mladen Vuckovic, who is also publicly known as the CEO of Medium Rare. In documents submitted to the CGA in 2024, Vuckovic reportedly declared assets exceeding $1 billion.

But the CGA’s own assessors were not convinced that Vuckovic was the true sole owner. FTM reported that internal records identified loans and payments—worth tens or even hundreds of millions of dollars—flowing from Medium Rare to companies and individuals connected to Craven and Tehrani. Neither Craven nor Tehrani was named in the license application.

In other words, the leak raises the possibility that the official paperwork did not reflect who really controlled one of the biggest crypto casinos on the internet.

1xBet and the Missing Answers

The leaked files also shed light on 1xBet, a gambling giant with a long and controversial history. Publicly, 1xBet has long been associated with Russian founders Roman Semiokhin, Dmitry Kazorin, and Sergey Karshkov, who died in 2023.

But the Curaçao company behind 1xBet, Caecus NV, lists Ukrainian national Ihor Hniedash as its owner and CEO. According to FTM, CGA assessors suspected that 1xBet actually had multiple owners. They reportedly asked Hniedash to explain his relationship with the Russian figures linked to the company. That information was apparently never provided.

Nevertheless, the CGA granted Caecus a license in 2024. The regulator later told FTM that it did not immediately reject companies whenever questions or uncertainties arose because Curaçao’s gambling industry was in transition to a new regulatory regime. For critics, that explanation raises an uncomfortable question: What is the point of asking for information if the license is granted anyway?

Platin Casino and SoftSwiss: More Revelations to Come?

Wittmann has hinted that the initial reports are just the beginning. One of her prominent claims involves an alleged €250 million tax loophole connected to Platin Casino, which she describes as “Germany’s largest illegal casino.”

She has also stated that leaked documents show software provider SoftSwiss is closely connected to companies operating hundreds of illegal casinos. If that is accurate, it would suggest that the infrastructure supporting the offshore gambling world is not separate from the licensed ecosystem—it is intertwined with it.

These claims are still being analyzed and have not yet been fully detailed in public reporting. But they indicate that the leak may go far beyond the ownership of Stake and 1xBet.

Curaçao’s ‘Light Touch’ Legacy

Curaçao is a small Caribbean island with an outsized role in the online gambling world. It has been licensing online casinos since the industry began, and it built a reputation for a “light touch” approach to regulation. That approach was intentional. Unlike large jurisdictions that conducted detailed due diligence and ongoing supervision, Curaçao offered speed, low fees, and minimal interference.

Under the old system, Curaçao did not issue licenses to individual operators in the way many other regulators do. Instead, a small number of private companies received “master licenses” and were allowed to extend sub-licenses to hundreds of smaller operators. This unusual structure made it easy for obscure entities to launch gambling websites while keeping the true owners hidden behind layers of corporate secrecy.

That secrecy was not merely a side effect. It was often the product itself. Operators serving players in countries where they were not allowed to operate used Curaçao licenses and shell companies to obscure who was really running the show.

Under pressure from the Netherlands, Curaçao has tried to reform. The old sub-licensing model has been abolished, and the CGA has said it is moving toward a more modern and rigorous regulatory framework. But the leaked files suggest that old habits are hard to break.

Why Do Ownership and Beneficial Ownership Matter?

Ownership questions are central to gambling regulation. A jurisdiction that cannot say who owns a gambling company cannot meaningfully punish anyone if things go wrong. Unlicensed or illegal operators can hide behind nominees, shell companies, and friendly trust offices in low-tax jurisdictions.

Regulators generally require information about “beneficial owners”—the real people who ultimately control a business. If that information is false, incomplete, or never verified, the entire regulatory system is little more than a paper exercise.

The Curaçao leak suggests that the regulator has sometimes approved licenses even when its own staff had unresolved questions about ownership and other red flags. That does not mean every Curaçao casino is a front for criminal activity. It does mean that the controls intended to keep bad actors out of the licensed system have not always worked.

How One Researcher Got In

Wittmann’s description of the hack suggests a surprisingly simple path into sensitive systems. She reportedly registered for the CGA portal using the name of a trust-office manager already known to the regulator. Instead of the manager’s own contact details, however, she used her personal Gmail address.

She also created a fictitious company called “DreamCatcher Private Foundation” and claimed to be making a license application on its behalf. Within days, her account was active. From there, she uploaded software that let her take control of the licensing system and access the data stored within it.

The technique is a useful case study in why regulators need strong identity verification, multi-factor authentication, and careful monitoring of access. The CGA has since said it contained the breach and identified its source, but the ease with which Wittmann walked in may worry every organization responsible for overseeing the gambling industry.

The Malta Connection

Wittmann is no stranger to regulatory battles. Earlier this year, she gained unauthorized access to a system belonging to the Malta Gaming Authority (MGA), the regulator for one of Europe’s most established online gambling licensing regimes.

The MGA obtained a preliminary injunction against Wittmann in Germany. The dispute also involves comments she has made about alleged links between the regulator and organized crime—allegations the MGA has rejected as unsubstantiated.

The Malta case adds another dimension to the Curaçao breach. Wittmann is not an anonymous hacker trying to sell stolen data. She has made a point of confronting gambling regulators directly, often using dramatic techniques to prove how vulnerable they are.

That style has made her a controversial figure. Supporters see her as a whistleblower exposing corruption and regulatory failure. Critics, including the regulators themselves, see an activist who breaks the law and then justifies the intrusion after the fact.

What the Curaçao Leak Could Mean for the Industry

The immediate impact of the leak is likely to be felt in boardrooms and trust offices far beyond Curaçao. If the leaked documents confirm that major brands are controlled by individuals other than the people named in license applications, the consequences could include regulatory action, payment-provider reviews, and closer scrutiny from banks.

For players, the stakes are also real. Gambling is an industry built on trust. If the true ownership of a casino is hidden or unclear, players have little way of knowing whether their money is safe. They also cannot verify whether the operator is compliant with the laws in their own country.

The leak could also influence regulators in other jurisdictions. Many European and Latin American countries have their own gambling markets, and they are increasingly concerned about operators that serve local players under offshore licenses. The same documents that exposed ownership questions in Curaçao could be used as evidence in other countries’ enforcement proceedings.

Curaçao’s Transition: Real Reform or Cosmetic Change?

The CGA has defended itself in part by pointing to the ongoing shift in Curaçao’s regulatory regime. The old sub-licensing model is gone, and the regulator has said it is building a stricter framework.

But the leaked records raise a difficult issue: If the transition is real, why were licenses still being granted to applicants with unresolved concerns? The CGA told FTM it did not immediately reject companies whenever questions arose. It presented this as an administrative choice during the transition. But to many observers, this looks like business as usual.

A genuine transition should be measured by the regulator’s willingness to raise the bar for applicants, not by its promises to do better next time. The leaked files could become a test of whether Curaçao is truly changing or simply finding new ways to manage old problems.

Open Questions After the Leak

Several major questions remain unanswered:

Key Terms to Understand

What is a “master license”?

A master license is a broad permission to operate gambling services. In Curaçao, holders were historically allowed to issue sub-licenses to other companies, creating a layer of indirection between the original licensee and the actual website operator.

What is a “trust office”?

A trust office in Curaçao provides corporate services such as incorporation, nominee directors, and registered addresses. These services are often used by offshore companies to obscure the identity of the real business owners.

What is a “red flag”?

In regulatory language, a red flag is a warning sign. When a licensing assessor sees an unusual payment, an unexplained corporate structure, or a mismatch between official records and reality, they flag it for further investigation.

The Bottom Line

The Curaçao leak is bigger than one hacker’s intrusion into a government computer system. It is a rare look inside the architecture of offshore online gambling—an industry built on degrees of separation, shell companies, and friendly jurisdictions.

Wittmann says she released the documents because she believes there is a public interest in revealing who controls Curaçao’s gambling companies. If the documents are authentic, they have already raised serious questions about the ownership of Stake and 1xBet, and they may eventually expose connections to dozens of other gambling sites.

The CGA, for its part, has acknowledged the breach and said it is investigating. But the damage is already done, at least in reputational terms. For years, Curaçao was known as a place where online casinos could operate with few questions asked. The leaked files suggest that the culture of leniency did not disappear when the old regulations were replaced.

As more documents are released, and more journalists begin to dig through the archive, the full story will continue to evolve. For now, one thing is clear: the gap between who the offshore gambling industry says it is and who actually controls it may finally be closing.