The story in one paragraph
Some players run third-party tools next to their poker client: table layouts, hand tracking, timers. If one of those tools can be updated from the internet, then whoever controls the update can run code on your computer. That is exactly what Jurojin says happened to its users. We read the reporting and kept only what the companies themselves confirmed, and we mark everything else as unproven.
What Jurojin says happened
In a statement published on 30 September 2026, Jurojin said its investigation found that an attacker intermittently replaced the update package delivered to one group of its users with a tampered version. Some of those packages contained a remote-access tool. According to PokerStrategy, the tool was MeshCentral, a legitimate open-source remote-management product that can be misused when installed without the owner's knowledge.
Jurojin says about 30 high-stakes players are known to have been targeted and that it emailed them privately. It describes the aim as seeing the targets' hole cards remotely and calls the operation "highly targeted" rather than a mass attack. It also says the same actor went after other applications, including IntuitiveTables, and ran phishing sites that imitated poker rooms and well-known poker tools.
IntuitiveTables, another tool maker, confirmed its own compromise right away, according to PokerStrategy. Jurojin says it keeps logs of every compromised version and the dates they were served, and has made them available to authorities and security teams.
What the poker sites say
According to PokerStrategy, no poker operator itself was reported as compromised, and GGPoker emailed customers after a routine inspection found MeshCentral on their computers. PokerShield's summary of the WIRED report adds the following responses from other sites:
Confirmed
- Americas Cardroom, which runs on the Winning Poker Network (WPN), said on 18 October that its review found no compromised game outcomes, so it will not issue refunds. On 4 November it turned on its ScreenShield feature, which hides table content such as hole cards from screen-capture tools, by default for every player, according to the network's own release. WPN had already switched it on from late September for players whose computers matched its detection criteria, and describes it as a precaution, not a finding that anyone cheated. A separate game-integrity inquiry is still ongoing. PokerShield, summarising WIRED; US Gaming Review, 7 October 2026
- WPN said it reviewed more than 2 million hands involving computers with the remote-access agent, about 200,000 of them linked to an account at the centre of the allegations, and found no evidence that hole-card knowledge was exploited. PokerShield, summarising WIRED
- CoinPoker said it investigated in 2025, banned a suspected account and returned more than 100,000 dollars to affected players. PokerShield, summarising WIRED
Still open
- How long the tampering lasted. Jurojin's early statement gives June 2025 to June 2026, while a later notice cited in the WIRED coverage says update packages were replaced between June 2025 and January 2026. The two accounts do not match, and we do not choose between them.
- How much money was lost. WIRED's sources put the losses of targeted players at 1.5 to 4 million dollars. That figure comes from people familiar with the case, not from verified records.
- How many people received the software. WIRED estimated more than 1,000 users of the two tools may have received it, while Jurojin says only a handful of high-stakes players were harmed in games.
- Who is behind it. Jurojin calls the attacker a "known cheater" without naming anyone. Names circulate in the poker community, but the reporting we read treats them as accusations and we do not repeat them.
What the reviews do and do not say
It is easy to read the reviews as a clean verdict, but they are narrower than that. WPN looked at hands from computers where the tool was found and says it saw no sign that the extra information was used, and Americas Cardroom, on the same network, says the same about game outcomes. Neither statement says that nothing was installed, that no cards were visible, or that other sites are the same. They answer the question "was it used to win hands on this network", and the answer, so far, is no evidence. WPN also says its own inquiry is not finished.
On the other side, a player who says they found the remote-access agent on their own computer and counted several screen-monitoring events estimates their losses at about 30,000 dollars. That is his own account, not an independent finding.
What this means for an online player
The reporting we read names high-stakes players as the targets. Even so, the mechanism is the point for everyone: a trusted tool, a normal update and a remote-access program that does not look suspicious.
Some habits follow from this, and they are our own advice, not claims from the reporting. Run only the third-party tools you really use and take them from the official source. Know what each one is allowed to do on your computer. If a tool you use has published a statement or a checking utility after an incident like this, read it. And keep in mind that a site's third-party software rules, such as the ones we described in our earlier article, exist partly because of cases like this.
For our own tools, the hand-history review in progressGTO runs in your browser and your hand histories do not leave it. That is a design choice that follows from exactly this kind of risk.
What we will do next
This story is not settled. The time window, the losses and the attribution may all change. We will add a dated note when a company or a court confirms something new, and correct this page if we got a detail wrong. If you see a statement we missed, write to [email protected].
known targets, according to Jurojin. The window of tampering, the size of the losses and the person behind it are still unproven or disputed.Source: PokerNews, PokerStrategy
Questions readers ask
What happened with Jurojin and IntuitiveTables?
Jurojin said an attacker intermittently replaced its update package for one group of users with a tampered version, some containing a remote-access tool, with the aim of seeing high-stakes players' hole cards. IntuitiveTables confirmed a compromise too.
How many players were affected?
Jurojin says about 30 high-stakes players are known targets. WIRED estimated that more than 1,000 users of the two tools may have received the software. Jurojin says only a handful were harmed in games.
Did the poker sites find cheating?
Americas Cardroom, which runs on the Winning Poker Network, said its review found no compromised game outcomes, and the network reviewed more than 2 million hands and found no evidence that hole-card knowledge was exploited; a separate inquiry is still ongoing. CoinPoker said it banned a suspected account in 2025 and returned more than 100,000 dollars.
Who is responsible?
That is unproven. Jurojin calls the attacker a known cheater but does not name anyone, and we do not repeat names that appear only as accusations.
How long did the tampering last?
It is disputed. Jurojin's first statement gives June 2025 to June 2026, while a later notice cited in WIRED's coverage says June 2025 to January 2026.
