Share 
Two new poker scandals erupted in late September, and ACR Poker was in the middle of both.
A product called TrenirusGTO was marketed as a poker training tool, though it was brazenly used to provide real-time assistance. This form of cheating was shown in a video from the X account “Trenirus,” being used during the early stages of an ACR Poker tournament.
Remote access attack targets high-stakes regulars
While that took over the poker narrative, a far more dangerous threat to the online poker world surfaced a couple of weeks later.
Cybersecurity expert WolfSec0x0 published a thread of more than 20 posts on X, detailing how at least one person was able to install remote-access software on other players’ computers, allowing them to see their hole cards and allowing them to access their whole system.
The cheaters did so by taking advantage of security flaws in two third-party poker tools, Jurojin Poker and IntuitiveTables. Both companies have reportedly fixed their security issues and released lengthy statements.
Accounts linked to alleged cheating operation
High-stakes regs were targeted in the attacks, with at least 30 players affected, for several million dollars. The following screen names were linked to the cheating operation:
- GGPoker: Paul Gregg
- CoinPoker: Europe
- WPN: JackKlompus
- WPN: OxOO
- WPN: Ez[Pz]
Victims report six-figure losses, partial refunds
Manuel Saavedra, who plays under the name J0hn Mcclean, said he was affected by the attack and lost well over $100,000 to these players. Spanish pro Ignacio Morón said he personally lost between $150,000 and $200,000 to this player, including $60,000 during a 15-minute heads-up session. Morón was also refunded $60,000 by Coin Poker.
The Spaniard also believes that the scammer, Paul Gregg, has cheated players out of more than $1 million on ACR Poker and over $1.5 million on GGPoker. Many believe that figure is far higher.
CoinPoker says it banned account earlier
According to CoinPoker ambassador Patrick Leonard, the Europe account was banned last year, with more than $100,000 confiscated and distributed to affected players.
“Our security team found somebody doing X. They banned him, confiscated $100K+…
“He made a big deal out of it, reported them to the gaming commission to claim $ back and protest innocence. We had no problem with that and built our case with full evidence, and agreed to go to court/do the case etc., but he didn’t continue his pursuit. The name on the account was… Paul Gregg.
“I’m sharing it only because I think in moments like this we should all stick together even if legally or whatever sites don’t want to share.
“From what I understand, there’s 0% chance he will be able to get by/continue on GG without it being an inside job OR security team being literally 1/10 in terms of competence.”
Screenshots show virtually impossible win rates
Various screenshots emerged on X showing that the ACR screen names above cheated players out of more than $1 million and that these players showcased virtually impossible win rates over a very extended stretch.
Phil Nagy responds with Screen Shield
In response, ACR Poker released a video four days later, with Phil Nagy both addressing the recent security issues and announcing a product called Screen Shield.
Screen Shield blocks Winning Poker Network accounts from using screen-capture or screen-sharing tools. Players have to opt in, and they cannot stream or screenshot results while it is active.
“Recent events have highlighted a security risk in online poker that can happen entirely on a player’s own computer. The Winning Poker Network has a security feature called Screen Shield designed to give players another layer of protection when software on a player’s device is able to capture or share what’s on their screen.”
The presentation also stated that WPN identified and directly contacted players with remote-access software installed on their computers.
“WPN contacted the players we identified as having software on their computers with remote access, screen sharing, or screen control capabilities. We activated Screen Shield for these players,” it said. “That does not mean we determined their computers were compromised. Software with these capabilities do have legitimate uses.”
The video then cut to Nagy, who offered his five-minute statement and vowed to share Screen Shield with other operators. That was a breakthrough, considering security teams at different poker sites very rarely work together.
“We have already taken action. We’ve contacted the relevant players directly on Tuesday and activated Screen Shield as an additional precaution.
“We’ll also be running regular scans of this type of remote-access software going forward, applying Screen Shield where detection and criteria are met.
“We found no compromises on the WPN side but that doesn’t mean we stop there. If we can add another layer of security and protection for players, we should.
“Our game integrity team is conducting a thorough investigation and relevant accounts are being reviewed and audited. We’re not going to speculate about individuals’ theories while that work is underway.
“If the investigation establishes wrongdoing or identifies harm to WPN players, appropriate compensation will be determined based on those findings.
“Player security is bigger than competition. We’ve sent other operators information on how this type of protection can be implemented so they can evaluate for their own players. If something we know can make online poker safer somewhere else, I think we should share it, and I hope other operators would do the same for us.”
Since the video back on Oct. 2, there have been no further updates from Phil Nagy or the Winning Poker Network team.
