The online poker superuser story has moved quickly. Less than 24 hours after allegations emerged involving remote-access software, suspicious high-stakes accounts and more than $837,000 in recorded WPN profit, a cybersecurity researcher now estimates that around 30 players may have had their computers compromised.
That turns what initially looked like an investigation into a handful of suspicious accounts into a potentially much broader security problem. Poker Type covered the original allegations in detail in our Poker Superusers investigation, but several important pieces of information have emerged since publication.
Around 30 High-Stakes Players May Have Been Affected
A cybersecurity researcher posting on X as WolfSec0x0 says approximately 30 Windows users have now been identified as potentially affected, spread across Europe, North America and Oceania. The researcher says the targets were high-stakes poker players and presented a timeline indicating that the alleged activity may stretch back to 2024.
That figure remains an estimate rather than a confirmed list of victims. No complete list of affected players has been released publicly, and Poker Type has not independently inspected the forensic evidence behind the claim.
The significance is obvious if the estimate holds up. A compromise affecting dozens of high-stakes players over a period potentially measured in years would be considerably larger than one suspicious heads-up match or one account running above expectation.
Researcher Points to Third-Party Poker Software
One of the most important developments is what the investigation does not appear to show.
WolfSec0x0 says the remote-access agent reached computers through compromised third-party poker software, rather than through the poker-room clients themselves. The researcher specifically said GGPoker and ClubWPT Gold were not involved in distributing the malicious software.
That distinction matters because accounts reportedly connected to the wider investigation have played on major poker networks. An account appearing on GGPoker, CoinPoker or WPN does not mean that operator’s software was responsible for infecting another player’s computer.
The researcher says two software vendors are now responding to the investigation. Neither has been publicly identified in the material we have reviewed, but WolfSec0x0 says that, based on the information currently available, neither vendor’s current software is still distributing the malicious code.
That is reassuring for current users, but it leaves a large hole in the story. Until the affected software is publicly identified or the vendors release their own findings, players cannot independently establish how the malicious installation occurred or precisely when the risk ended.
MeshAgent Could Do More Than Reveal Hole Cards
Yesterday’s story focused heavily on the obvious poker advantage: seeing somebody else’s cards.
The new technical claims make the potential compromise considerably more serious. According to WolfSec0x0, the hidden MeshAgent installation could potentially allow whoever controlled its server to watch the computer screen in real time, operate the mouse and keyboard and access information stored on the machine.
That could theoretically expose browser sessions, saved credentials and other private information alongside whatever was displayed on a poker table. MeshAgent itself remains legitimate remote-management software, but an unauthorized installation controlled by an attacker effectively turns that functionality against the computer’s owner.
This also explains why Patrick Leonard reacted so strongly to the story. Leonard described the situation as one of the biggest events to hit online poker and urged desktop players, particularly high-stakes players who use third-party software, to review their security and change important passwords.
Patrick Leonard Reveals Previous $100K CoinPoker Case
Another striking development concerns an incident that apparently predates the current malware allegations.
GipsyTeam has published a screenshot of a statement attributed to Leonard in which he says CoinPoker’s security team identified illegal activity involving an account registered under the name Paul Gregg approximately two years ago. According to Leonard’s account, the player was banned and around $100,000 was confiscated before being returned to affected players.
Leonard further claimed that the player disputed CoinPoker’s decision and took the matter to the relevant gambling commission while maintaining his innocence. Leonard said CoinPoker was prepared to defend its decision and evidence, but that the challenge did not ultimately proceed.
That is a significant addition to the story, but it needs an equally significant qualification.
Poker Type has not found a new detailed statement from CoinPoker independently confirming Leonard’s version of that earlier case. More importantly, Leonard’s account does not establish that the incident two years ago involved MeshAgent, compromised computers or the same alleged method now under investigation.
Those are separate claims unless further evidence connects them.
Alleged Activity May Date Back to 2024
The timeline is another reason this story is getting bigger rather than fading after a day of Poker X speculation.
WolfSec0x0’s investigation dates the suspected remote-access activity back to 2024. Separate reporting from PokerFlow has alleged that investigators compared MeshAgent records, poker hand histories and connection times after the software was discovered on a player’s computer.
PokerFlow has gone considerably further, estimating that accounts linked to the alleged scheme may have made around $2 million across cash games over approximately two years. That number should not be confused with the much firmer $837,000 figure from the SmartHand screenshots discussed yesterday, which represented recorded combined profit for the WPN accounts OxOO and JackKlompus rather than proven proceeds of cheating.
At this stage, the $2 million figure remains an estimate from community reporting. It has not been established by an operator, law-enforcement agency or court.
The Poker Rooms Still Have Questions to Answer
What we do not yet have is arguably as important as what has emerged.
There is still no comprehensive public report from the major operators setting out which accounts were investigated, what evidence they received, how much money was frozen or confiscated, which players were reimbursed and whether their investigations have established links between the various screen names.
There is also no public victim list confirming the approximately 30 affected computers.
The distinction between this investigation and unrelated technical problems is also worth keeping clear. PokerStars and CoinPoker both suffered intermittent crashes during a huge online poker weekend, but there is currently no evidence connecting those outages to the alleged remote-access attacks.
For players, that uncertainty is uncomfortable. Online poker security has traditionally meant trusting the operator to protect the game running inside its client, but this case raises the possibility that an opponent could obtain the decisive information before the poker room ever had a chance to protect it.
Yesterday, five reported poker accounts and an $837,000 profit figure dominated the story. Today, the more important number may be 30, because if dozens of high-stakes players really were compromised, finding out who they played, when they were exposed and exactly how the software reached their computers could take this investigation well beyond one alleged superuser.
