GGPoker, ACR & CoinPoker Malware Cheating Scandal: What We Know
Updated: Oct 16
A potentially major online poker cheating scandal is developing after high-stakes players reported that their computers may have been compromised by remote-access software, potentially allowing opponents to see their hole cards in real time.
The allegations involve games played on GGPoker, ACR and CoinPoker, with early reports claiming that more than 10 high-stakes regulars may have been targeted and that the financial damage could run into millions of dollars.
But this is not a conventional superuser allegation. The information currently available points toward something very different: the poker players' own computers may have been compromised.
Remote-management software identified as Mesh Agent has become a central part of the investigation. If attackers had remote access to an infected player's screen, they could potentially see the same poker table — and the same hole cards — visible to the victim.
The story is still developing, and several major claims remain unverified. Here is what we know so far about the GGPoker, ACR and CoinPoker malware cheating allegations.
Table of Contents
🚨 Update: Jurojin Confirms Its Update Infrastructure Was Compromised
The story changed materially in October 2026 when Jurojin confirmed that its software-update infrastructure had been compromised in a targeted attack affecting a limited group of poker players.
This is a major development because it provides a concrete potential infection vector for at least part of the malware activity discussed in this article. It does not mean that GGPoker, ACR or CoinPoker servers or random-number generators were compromised.
The confirmation also changes the evidentiary picture: the existence of a compromised update channel is now documented by Jurojin, while other claims surrounding the scandal — including the full number of affected players, the identity of the attackers and the total financial damage — should still be treated separately unless independently established.
🚨 What Happened in the Poker Malware Scandal?
Reports emerging from the high-stakes poker community describe a sophisticated form of alleged cheating that may have operated for an extended period.
Rather than hacking a poker room, the attackers allegedly compromised individual poker players' computers. Remote-access software was reportedly discovered on machines belonging to high-stakes regulars.
This distinction is extremely important. If the allegations are correct, GGPoker, ACR and CoinPoker would not need to have been hacked at all.
An attacker would instead need access to the computer of the person sitting on the other side of the virtual poker table. Once that access existed, the attacker could potentially observe information displayed on the victim's screen — including the most valuable information possible in poker: their hole cards.
💻 How Could Cheaters See Hole Cards?
The alleged attack revolves around remote access to a player's computer.
Imagine two players sitting at an online poker table. Player A sees only his own cards. Player B should see only his own cards. But if Player B or an associate secretly had remote access to Player A's computer, they could potentially see both sides of the hand.
There would be no need to predict what Player A was holding, crack the RNG or access the poker room's servers. The information would already be visible on Player A's screen.
This would provide an extraordinary advantage in situations involving bluffs, hero calls, value bets, river decisions and large all-ins. At high stakes, even a limited number of compromised opponents could potentially translate into enormous profits.
🎯 Why Were Certain High-Stakes Players Targeted?
One of the most interesting parts of the allegations concerns who the suspicious accounts were playing against.
According to the original reports, suspicious results appeared to be heavily concentrated against a particular group of regulars. It has been alleged that more than 90% of one suspicious player's hands were played at tables where certain targeted players were present.
That claim has not yet been independently verified. But if it proves accurate, it would be consistent with the alleged attack method.
An attacker would have an enormous informational advantage against an opponent whose computer had been compromised. Against everyone else, that advantage would disappear. This could potentially explain why suspicious performance might appear opponent-specific rather than universally abnormal.
💰 Were Millions Really Lost?
Initial reports claim that more than 10 high-stakes poker players may have been affected. The alleged total losses have been described as reaching several million dollars across games played on multiple poker sites.
Those numbers should currently be treated as reported figures rather than established facts. The Poker Broker has not seen sufficient public evidence to independently calculate the total amount lost or confirm the exact number of affected players.
However, the stakes involved make the scale plausible enough to warrant serious attention. Until complete account investigations, hand histories or official statements become available, there is no reliable final figure.
🕵️ How Was the Alleged Poker Cheating Discovered?
The investigation reportedly began after high-stakes players noticed unusual results involving particular opponents.
The concern was apparently not simply that somebody was winning. Poker naturally produces extreme winning and losing stretches. Instead, players reportedly identified unusual patterns connecting suspicious results with particular opponents.
That led members of the community to examine the situation more closely. The investigation eventually moved beyond poker statistics and toward the players' computers themselves.
Remote-management software and associated system activity reportedly became part of that investigation. Members of the high-stakes community have since publicly stated that multiple players appear to have been affected. However, the complete forensic investigation has not yet been released publicly.
⚠️ What Is Mesh Agent?
A name appearing repeatedly in discussion of the scandal is Mesh Agent.
Mesh Agent is associated with MeshCentral, an open-source remote computer management platform. This is important: Mesh Agent itself is legitimate software.
Remote-management technology is commonly used by IT administrators to manage computers and provide technical support. MeshCentral can provide functionality including remote desktop access, terminal access and file management.
The security problem arises when remote-management software is installed or controlled without the computer owner's authorization. If somebody secretly gained this level of access to a professional poker player's machine, the attacker could potentially observe the desktop while poker was being played.
Therefore, calling Mesh Agent itself “poker malware” is not technically precise. The allegation is that legitimate remote-access technology may have been deployed maliciously on poker players' computers.
❓ How Did the Malware Reach Poker Players?
This remains one of the biggest unanswered questions.
Several possible infection vectors are being discussed within the poker community, including phishing links, fake websites and third-party poker software.
One poker utility, Intuitive Tables, has been mentioned during community discussions as a possible vector. At present, however, there is not sufficient publicly available evidence to establish that Intuitive Tables distributed malicious software or that its developers were involved in the alleged attack.
The Poker Broker will not present an allegation against a specific software provider as fact without supporting evidence. The actual infection method therefore remains unconfirmed.
Regardless of the eventual explanation, serious players frequently install HUDs, table-management software, hotkey applications, hand-history tools, scripts and other poker utilities. Many require substantial permissions, making a high-stakes poker player's computer a valuable target.
🃏 GGPoker, ACR and CoinPoker: What Do We Know?
The three major poker platforms repeatedly mentioned in connection with the reported games are GGPoker, ACR and CoinPoker.
This does not mean that all three poker rooms were hacked. Based on the information currently available, there is no established evidence showing that the central servers or RNG systems of GGPoker, ACR or CoinPoker were compromised.
Instead, the allegations concern players competing on those networks whose personal computers may have been compromised.
Community reports also claim that accounts connected to the investigation have been banned on multiple platforms. Those reports require further confirmation from the operators.
One particularly interesting development is a screenshot circulating within the poker community that appears to show GGPoker displaying a security warning about potentially dangerous software detected on a player's computer. That could indicate that GGPoker is aware of the underlying security concern. The Poker Broker is waiting for additional information and official statements before drawing broader conclusions.
🛡️ How Can Online Poker Players Protect Themselves?
This story should not cause players to assume that every poker computer has been compromised. It should, however, serve as a reminder that online poker security extends beyond the poker client itself.
Players — particularly professionals and high-stakes regulars — should consider keeping their poker environment as clean as possible.
Avoid installing unnecessary software on a poker machine. Be extremely cautious with files received through Telegram, Discord, email or private messages. Do not install unknown “security scanners” simply because somebody posts them in a poker group.
Use unique passwords and multi-factor authentication whenever available. Avoid storing significant cryptocurrency balances or sensitive wallet credentials directly on a poker computer. Keep operating systems and trusted security software updated.
For players with substantial bankrolls online, using a dedicated computer exclusively for poker can significantly reduce the number of potential attack vectors.
🔎 What Is Confirmed and What Remains Unverified?
What we know: Mesh Agent and MeshCentral are real remote-management technologies capable of remote desktop and other administrative functionality. A major discussion and investigation is taking place within the high-stakes poker community, and multiple community members are reporting potentially compromised poker computers.
What remains unverified: the exact number of affected players, the exact amount of money lost, whether the total reaches several million dollars, the complete identity and number of attackers, the complete list of suspicious accounts, the infection vector, whether any specific third-party poker application distributed malicious software, the complete duration of the alleged operation and how much money may ultimately be recovered.
The Poker Broker will update this article as stronger evidence and official information become available.
💭 Final Thoughts
If the central allegations are confirmed, the GGPoker, ACR and CoinPoker malware cheating scandal could become one of the most important online poker security stories of 2026.
Not necessarily because poker software itself was compromised, but because it demonstrates a fundamentally different way of attacking an online poker game.
You do not necessarily need to hack the poker room if you can hack the poker player.
The RNG can work perfectly. The poker server can remain secure. There does not need to be an internal superuser. If an attacker can secretly observe another player's screen, the fundamental information barrier that makes poker possible disappears.
For professional players, protecting passwords and bankrolls is no longer enough. Players may also need to think seriously about protecting the machine on which their cards actually appear.
This story is still developing. The Poker Broker will continue following the investigation and update this page as GGPoker, ACR, CoinPoker, affected players or security researchers provide additional verified information.
For poker-room information, private deals or assistance, contact The Poker Broker on Telegram.
❓ Frequently Asked Questions
What is the GGPoker, ACR and CoinPoker cheating scandal?
High-stakes players are investigating allegations that some poker computers were compromised with remote-access software, potentially allowing attackers to see opponents' hole cards during online games.
Were GGPoker, ACR or CoinPoker hacked?
There is currently no established evidence that the poker-room servers themselves were hacked. The allegations primarily concern individual players' computers.
What is the poker malware involved?
Reports have focused on Mesh Agent, software associated with the legitimate MeshCentral remote-management platform. The concern is not that Mesh Agent is inherently malicious, but that remote-access technology may have been installed or controlled without players' authorization.
Could malware really reveal poker hole cards?
If an attacker obtains unauthorized remote access that allows them to view a player's desktop, information displayed on that desktop could potentially be visible remotely. That could include hole cards displayed by a poker client.
How many poker players were affected?
Initial reports suggest that more than 10 high-stakes regulars may have been targeted. This figure has not yet been independently confirmed.
Were millions of dollars stolen?
Community reports claim that the combined losses may reach several million dollars, but there is currently no independently verified final loss figure.
Was Intuitive Tables responsible?
There is currently insufficient public evidence to establish that Intuitive Tables distributed the malicious software or that its developers were involved. Claims about the infection vector remain under investigation.
Are GGPoker, ACR and CoinPoker safe to play?
The allegations currently concern compromised player computers rather than an established compromise of the poker rooms' servers or RNG systems. Players should nevertheless maintain strong computer security and monitor official information as the investigation develops.
