Poker tool hack may have won $1.5m to $4m from players, report says

An attacker who allegedly hijacked updates to two poker tools may have won between $1.5 million and $4 million by seeing high-stakes players’ private cards, GamblingNews reported, citing another outlet’s investigation. The report also draws on statements from poker operators and a security firm.

The details

The tools, Jurojin and IntuitiveTables, let professionals play several tables at once. The attacker allegedly used their updates to install MeshAgent, a remote-access tool that can watch screens and control a computer. Cybersecurity specialist WolfSec said more than 1,000 users could have received compromised software, but the malicious functions were switched on selectively, reportedly using a list of targeted poker usernames.

Jurojin confirmed that altered update packages went to a small subset of users, intermittently, between June 2025 and January 2026.

A professional player known as Alex found the malware in September 2026 after an AI assistant flagged suspicious activity. He found 11 apparent cases of screen monitoring, 10 of them in sessions against the same opponent on Americas Cardroom (ACR). He estimates he lost about $30,000.

How operators responded

• CoinPoker: says it detected the account in 2025, banned it and repaid more than $100,000 to affected players.
• ClubWPT Gold: suspended an account after a complaint and refunded the player’s losses in the affected session.
• GGPoker: coach Patrick Howard said that in early September 2026 the operator reportedly told him his statistical evidence was not enough to act at that time. On 15 October it announced a ban on third-party poker software and systems to detect abnormally high win rates. It said it had traced suspected proceeds to a crypto wallet and contacted Coinbase, and passed information to law enforcement and industry watchdogs.
• ACR: told customers on 18 October that its analysis of more than two million hands showed no sign game outcomes were compromised. It ruled out refunds but said it would add protection against screen-monitoring software.