for early access to the latest igaming videos!
and get the latest igaming news first!
The recent hack into Curaçao’s gambling regulator has pulled back the curtain on one of the world’s most secretive gaming hubs. A Berlin-based cybersecurity researcher, Lilith Wittmann, has claimed responsibility for the breach, which the regulator confirmed in a press release last week.
Tens of thousands of confidential files were taken from the Curaçao Gaming Authority’s licensing system over nine months, exposing the identities of hundreds of casino owners who had long remained hidden behind letterbox companies.
Dutch publication Follow the Money (FTM) investigators found that licences were often granted even when applicants failed to answer key questions or when ownership structures were unclear.
The revelations stretch across continents, but a large share of the exposed owners are based in Europe, particularly in Ukraine, the United Kingdom and Cyprus.
Lots of red flags in Curaçao’s licensing system
Curaçao’s licensing system has for decades attracted operators who could not secure approval in their target markets. Master licences were issued to private firms, which then sold sublicences with little oversight. This gave gambling companies access to payment networks and casino software providers while keeping their true owners out of sight, the report revealed.
The leaked files also showed fortunes built on this model. One Dutch owner of Blaze.com declared assets of €800 million, while his American partner reported €500 million. Another figure tied to Qbet.com faced a record fine of nearly €25 million in the Netherlands. Despite such warning signs, licences were still granted, raising questions about how oversight was applied.
The documents also show how big names like 1xBet and Stake were licensed despite unresolved ownership questions.
“This is a business that is highly susceptible to money laundering,” one expert said, pointing to large transactions involving cryptocurrencies. Stake, promoted by rapper Drake and linked to tech billionaires Ed Craven and Bijan Tehrani, was officially registered under another name, leaving doubts about who really controls the company.
Similarly, 1xBet was licensed even though regulators suspected multiple owners and lacked full disclosure.
In another case, auditors noted that moving 350 casino domains without warning players was “unfair,” yet the licence was still continued. Another report criticised the use of “Askgamblers” as an arbitration board, calling it unfair because of business ties to the applicant.
The Curaçao Gaming Authority admitted that licences had been granted despite unanswered questions, but said the industry was in a transition period under new laws passed in 2024.
The authority also said it had closed the security gap that had allowed Wittmann access for nine months.
This is the second major regulatory breach this year involving Wittmann, following the Malta breach in March. She has since been served a preliminary injunction by the Malta Gaming Authority to prevent her from speaking about her findings.
