Poker Superuser Scandal: Sites Were Warned Before It Broke
New reporting says poker sites got early warnings about a suspicious account at the center of a superuser cheating scandal. Here's what's known.
New reporting says at least two online poker sites were warned about a suspicious account called 'Paul Gregg' well before a superuser scandal broke publicly. PokerNews reports one site banned the account and refunded players years ago, while another only acted after a September warning. The case involves alleged remote access to hole cards affecting around 30 high-stakes players.
- The scandal allegedly targeted around 30 high-stakes poker players over roughly two years
- One site confiscated $100,000 from the account and refunded cheated players, PokerNews reports
- Victim Ignacio Moron says he lost between $100,000 and $200,000, including $60,000 in 15 minutes
- Poker coach Patrick Howard reported the account to GGPoker in September
- Jurojin Poker says it was one of several apps targeted, alongside IntuitiveTables
What is the poker superuser scandal about?
A poker superuser scandal is drawing fresh attention after cybersecurity researcher @wolfsec0x0 detailed an attack dating back roughly two years. The claim: third-party software let an attacker see another player's hole cards during online sessions.
The account at the center is known as 'Paul Gregg.' PokerNews reports it allegedly targeted around 30 high-stakes players, giving the user an enormous edge in real-money games over an extended stretch.
That edge is the heart of why this story has spread so fast. A player who can see opponents' cards doesn't need skill to win; they just need access, and access like that can run undetected for a long time if nobody is checking closely.
Were poker sites warned before the scandal broke?
Yes, according to new reporting cited by PokerNews. Two sites reportedly received alerts about the Paul Gregg account before the story went public this week.
One site acted on the warning. It banned the account, confiscated $100,000, and refunded affected players, PokerNews reports, citing Poker Red's earlier coverage of the case.
A second site did not move as quickly. Poker coach Patrick Howard of Mobius Poker says he submitted a report to GGPoker in September flagging suspicious behavior, without directly accusing the account of cheating.
Howard has said publicly that the scandal 'will change online poker forever.' He has also said GGPoker reached out to him about its investigation after his report, according to PokerNews.
Who says they were cheated, and by how much?
Poker pro Ignacio Moron is named as a victim. He estimates losses between $100,000 and $200,000 to the superuser account, including one stretch where he was taken for $60,000 in just 15 minutes.
High-stakes player Mario Mosbock, an ambassador for a separate unregulated site, confirmed that site's security team caught the account more than two years ago. Its team also confiscated $100,000 before banning the user.
Pro Patrick Leonard says his site flagged the account about a year ago, after less than a week of play, because its win rates and showdowns looked implausible. He says around 100 players had raised suspicions to sites years earlier.
Leonard wrote that the account kept winning and withdrawing at rates that didn't make sense, yet was allowed to keep playing. That claim, if accurate, suggests warnings were available long before any site took decisive action.
What do the affected poker apps say happened?
Jurojin Poker, one of two software products named in the breach, released a statement this week. It described the attack as targeted, not a mass hack, carried out by a 'known cheater' aiming at specific high-stakes opponents.
According to the statement, Jurojin was one of several applications hit by the same actor, alongside IntuitiveTables. The same person is also said to have run phishing sites that impersonated poker rooms and poker tools.
It remains unclear exactly how many poker sites were exposed by the breach overall. PokerNews reports the attack appears to have been narrowly aimed at a few dozen players rather than a broad, indiscriminate hack.
What does this mean for online poker going forward?
Patrick Leonard says the real test is whether sites will investigate and act on bots and suspicious standalone accounts, rather than wait for players to force the issue. 'The future of online poker is in the hands of the sites,' he wrote.
The case echoes older scandals, including Russ Hamilton's 'POTRIPPER' account, which cheated Absolute Poker and Ultimate Bet players out of millions in the late 2000s. Trust in site security remains central to how players choose where to play.
As the investigation continues, more details about which sites were warned and when may come out. For now, the known facts point to missed opportunities to stop the account sooner.
What it means for players
For players anywhere, the lesson is about vigilance rather than panic. Keep screen-sharing and remote-access software off during real-money sessions, watch for opponents whose results look statistically implausible, and report suspicious accounts early rather than assuming a site will catch it. Reviewing basic poker strategy and tells can help you spot when something about a game doesn't add up, and a clear bankroll plan limits damage if a site is slow to act on a warning.
Frequently asked
What is a superuser scandal in poker?
It's when someone gains an unfair information edge, such as seeing opponents' hole cards, often through hacked or malicious software. This scandal involves an account called 'Paul Gregg' allegedly using third-party tools to view cards remotely.
Which poker sites were warned about the account?
Reporting cited by PokerNews says two sites received warnings, though not all site names are confirmed. One site banned the account and refunded players years ago, while another acted after a September 2026 report.
How much money was involved in the scandal?
One site confiscated $100,000 from the account. Victim Ignacio Moron says he personally lost between $100,000 and $200,000, including $60,000 lost in just 15 minutes.