Transparency Lost: Online Poker Bots and Cheaters and Cover-Ups

News from the online poker world of late has been filled with accusations and evidence of bots. One story after another has shown that bots and other forms of unethical behavior have infiltrated the online environment. Worse, these are not isolated incidents but patterns of conduct that are now becoming more obvious to those with the skills to identify them.

Sadly, those identifying the bots and cheaters are often players on those sites. Online poker operators, many of which have allowed security lapses to become almost unmanageable holes in the system, try a variety of remedies to make the problems go away. That doesn’t seem to be working this time.

Has the poker community truly had enough?

Happy New Year from GGPoker

As everyone was welcoming 2024, some online poker players were discovering what the term “superuser” means. (For those who don’t remember the UltimateBet scandal involving Russ Hamilton, a superuser is one who uses knowledge of the inner workings of a poker site to see players’ hole cards, thereby gaining an unfair advantage used to cheat.

On December 28, 2023, a person calling themselves “GGSuperUser” posted a Two Plus Two forum thread claiming that a player named “Moneytaker69” was cheating on GGPoker. Evidence pointed to the player being able to see unexposed cards, akin to the operation of a superuser account.

In less than 24 hours, GGPoker announced a security update. Claiming that it – not the person who compiled the evidence and presented it to GGPoker – found that the “Moneytaker69” player displayed “unusual game patterns.” The site’s technical security team then investigated, found the issue, and fixed the glitch that made the cheating possible.

“Under a specific set of circumstances related to the ‘Thumbs Up/Down Table Reaction’ feature, which involves decompilation of our Windows game client, interception of network traffic, and alterations of our game packets, Moneytaker69 was able to customize his own game client. These customizations could only be made to our Windows desktop game client since part of our desktop client leverages the Adobe Air framework, which has attack vectors that other frameworks do not. At no point was the user able to access our servers or server data, including others’ hole cards. Through this customized game client, he was able to deduce all-in equity by exploiting a client-side data leak vector.”

After all was said and done, GGPoker banned “Moneytaker69” and confiscated $29,795 in unfair winnings. Victimized players received refunds.

GGPoker followed up with an apology that caused poker players to worry about the site’s integrity and security. The statement asserted that the company continues to work hard “not to disappoint” its players. In addition, it claimed to be actively working to double the size of its technical security team, “enlisting help from renowned security professionals” to ensure player safety.

Remember the Poker Integrity Council?

In the summer of 2022, GGPoker made news by hosting a press conference during the WSOP Main Event in Las Vegas. There was a new group in town, pledging to fight cheating in poker.

The Poker Integrity Council (PIC) consisted of a group of poker representatives led by GGPoker Ambassadors Jason Koon and Fedor Holz. LearnWPT instructor Andrew Lichtenberger was a member of the original group, as was Seth Davies representing Run It Once and Nick Petrangelo of Upswing Poker.

Further, companies that appeared to be willing to work with PIC included the World Series of Poker and World Poker Tour, RunGood Poker Series, Asian Poker Tour, Triton Poker, King’s Casino, and the PokerGO Tour. All agreed to sign on to any “industry-wide blacklist” that may emerge from the council’s work.

The goals of PIC were multi-faceted but focused on three points:

• Detect suspicious online poker behaviors flagged for review that may involve collusion, bots, or ghosting
• Review allegations of suspect hand histories with player names/stakes anonymized to remove dangers of favoritism or bias
• Vote of council members to decide upon disciplinary action

Interestingly, the formation of PIC and the fanfare around the announcement aimed to quiet community concerns of cheating by players like Bryn Kenney, Ali Imsirovic, and Jake Schindler. All three men, despite evidence of online poker cheating, played the WSOP that summer without shame.

Today, the URL that had been dedicated to the PIC on GGPoker is no longer valid.

Happy New Year from ACR Poker

As 2024 began, ACR Poker (formerly Americas Cardroom) was preparing to launch satellites for its next Venom tournament. But the client had been experiencing quite a few issues over the holidays. There were delays in deposits, missing transfers, and tournament troubles, as ACR acknowledged on Christmas Day and surrounding days.

While the company addressed the issues on social media, WPN CEO Phil Nagy thought it would be a good idea to wear a Santa hat, recite a long poem as a Christmas story, and then apologize. The apology also included Nagy noting that he hadn’t slept in several days and forgot to even call his mother on Christmas Day.

An important message from our CEO @WPN_CEO. In the midst of these not-so-festive events that some of our players have faced during the holidays, we're here for you #ACRPoker pic.twitter.com/lq07IzZ8ru

— ACR Poker (@ACR_POKER) December 27, 2023

Finally, on December 28 and 29, ACR claimed to have issued refunds for players affected for the past week in SNGs, cash games, Blitz, jackpots, and on-demand games, followed by those in affected tournaments and financial transactions.

Problems persisted through the end of the year, however. ACR’s Twitter feed was filled with messages about the troubles.

“We will have downtime for maintenance…”

“The schedule maintenance downtime for today…has been extended.”

“Most of our games are back up and running…”

“We will be back up ASAP… We appreciate your patience…”

Even the December 30 message that all problems had been resolved, the company offered a “reduced” tournament schedule for December 31 “to ensure a smoother gameplay experience.”

From Technical Difficulties to Bots

Just as WPN hoped to put the problems behind them and focus on the Venom, “TylerRM” posted a new thread on Two Plus Two. While people randomly accuse poker sites of enabling bots all the time – with little to no evidence – this person called the thread “Botfarm won $10 million on WPN” and included receipts. (WPN is the Winning Poker Network, the parent company of ACR Poker and its sister sites like Black Chip Poker. They utilize the same player pool.)

According to the post, there have been allegations of a bot farm operating on WPN for years. And despite some evidence to go with those allegations, WPN reportedly ignored those concerns. “TylerRM” posted numerous files showing a proliferation of bot-style activities in cash games and tournaments, along with a list of hundreds of accounts that appear to participate.

Other players piled on and added their evidence, all indicating that there is a massive bot problem on WPN. Perhaps it hadn’t been a conspiracy theory after all.

However, instead of Randy “nanonoko” Lew or someone else affiliated with the security team at WPN, the company sanctioned two of its team pros to take on the issue. Chris Moneymaker and Ebony Kenney had the best intentions, putting themselves on the line for the company for which they work and in which they believe. They reminded the public that they are poker players before ambassadors and work hard to address the public’s concerns behind the scenes.

The sincerity was undeniable.

Then, they issued the challenge. The first person to “make a bot” and “make it operate on WPN for 5,000 hands.” By showing them proof, the person would win $100K and a job with WPN. There were no other stipulations on the offer.

Think we got a bot problem? We don't. Prove us wrong and win 100k. Check the video for details.
1 winner only 👉 READY… SET… GO 💪 pic.twitter.com/ta6k9rEvlM

— ACR Poker (@ACR_POKER) January 5, 2024

Then, they issued the challenge. The first person to “make a bot” and “make it operate on WPN for 5,000 hands.” By showing them proof, the person would win $100K and a job with WPN. There were no other stipulations on the offer.

Never Mind

This all went wrong very quickly. In less than 12 hours, Matt McElligott of RangeTrainer Pro created the bot and had it running on ACR. Moneymaker confirmed that he was the first to claim to have done it, so McElligott sent the proof of playing 5,000 hands.

That same night, ACR posted a tweet to address the moving of the goalpost, noting – for the first time – the parameters of the challenge. Even then, there was confusion and so many questions.

We are following the conversation about our Bot challenge and monitoring the play on our network. At this time we can confirm that no one has completed the challenge.

For clarity there are only a few basic requirements to complete the challenge:
1) Create a bot that could pull…

— ACR Poker (@ACR_POKER) January 6, 2024

The next day, WPN pulled the entire challenge and apologized.

We owe our players an apology. Here is our statement regarding our decision to cancel our Bot Challenge.

Sincerely,
The Winning Poker Network Team pic.twitter.com/yA4itj3273

— ACR Poker (@ACR_POKER) January 6, 2024

Not only did the challenge fail to prove or disprove anything about bots on WPN sites, it became a public relations failure in a series of them for the company.

Day after day passes with no acceptable response from WPN and/or Nagy regarding bots, nothing to dispute the evidence of bots or to show the public how the company claims to protect against bots. Site ambassadors, team pros, and livestreamers are left to defend the site but with nothing to back up their assertions that ACR Poker is safe from bots.

Many players are reporting that they are withdrawing their funds from ACR Poker. Any true traffic decreases will show in the coming weeks and in the entries for the January Venom PKO.