Skip to content

Curaçao Secrets or Complete Bullshit?

A hacker spent nine months inside the Curaçao gambling regulator and Follow the Money published the files on 22 September. The news is not new, but we could not skip it. Our view, the facts and where to read the investigation.

Alex Jovanovic Crypto casino analyst

Published
CASINO NEWS

This news is not new. The Casino Secrets investigation came out on 22 September, and most of you have probably seen the headlines already. I still could not leave it out. Many of you play at casinos with a Curaçao licence, so it matters here too. First my honest view, then the facts.

  • What: a leak from the licensing system of the Curaçao Gaming Authority (CGA), the island’s gambling regulator.
  • Who: Lilith Wittmann, a hacker and researcher from Berlin.
  • Published: 22 September 2026 by Follow the Money, with NRK, NDR, Jetzt and SVT.
  • Access: from December 2025 for about nine months, by Wittmann’s account.
  • Scale: more than 84,000 documents, over 2TB of data and more than 1,000 iGaming companies, according to the project site.
  • Best known name: Stake.
  • Arrest linked to the story: a raid on 8 September in Frankfurt. Reporters link it to Platincasino.
  • Player data: none of the reports we read says player accounts were in the files.

My honest view

I will be straight with you. To me, leaks like this are mostly noise. I do not care what leaked or where it went. I have no wish to dig through other people’s passports and tax papers, and I will not do it.

What bothers me is something else. There are always people who keep throwing sticks in the wheels of this industry. Every few months there is a new leak, a new dossier and a new loud headline. I keep asking myself why they do it and who it is for. I think a lot of it comes from envy. I see very little real help for ordinary players in it.

That is my opinion, and you are free to disagree. Wittmann says she did it because society should know who owns these companies. Her own words are linked below, so you can judge for yourself.

For me the questions stay the same. Does the casino pay? Is the game fair? Does support answer? That is what we test, and none of it changed on 22 September.

What happened

Wittmann got into the CGA licensing portal at the end of 2025. In her account, she first logged in on 3 December under a made-up identity and had full access within about eight hours. She says she stayed in the system for nine months.

On 17 September 2026, at about 22:00, she sent the regulator her questions. By her account, the hole was closed about half an hour later. Five days later the Dutch newsroom Follow the Money published the story together with media partners in Norway, Germany, Austria and Sweden.

What the files contain

  • Company papers. Names of owners, licence applications and the regulator’s own assessments.
  • Personal papers. Passports, tax returns and financial details of owners.
  • Owner records. Follow the Money checked 897 owner records for 767 people by hand. It says it used only documents obtained in December 2025.
  • Licences. Wittmann counts 550 active licences at €47,450 a year each, plus fees.
  • Domains. About 8,200 casino domains were on file when she sent her questions.

The files described are papers of companies and their owners. None of the reports we read says player accounts or balances were part of the leak.

The project site lists more than 84,000 documents from Curaçao and over 2TB of data. More than 40,000 documents can be searched there. The journalists also match the files against public company registers in Malta, Cyprus, Gibraltar and Curaçao, and against papers from the Malta Gaming Authority.

This is the part that worries the industry most. The files are now open to anyone. Police, tax offices and reporters in any country can look up a company with a Curaçao licence and the people behind it. The reporters also write plain language stories about single casinos, so the papers are easier to read for people outside the trade.

What it says about Stake

Stake is the biggest name in the story. Ed Craven and Bijan Tehrani are widely known as its founders. According to Follow the Money, the Curaçao company behind Stake, Medium Rare NV, is registered to Mladen Vuckovic. In a 2024 filing he declared assets of more than $1 billion.

Follow the Money reports that officials at the regulator asked whether he was really the only owner. They noted large loans and payments from Medium Rare to companies and people linked to Craven and Tehrani. Neither man was named in the licence application. The licence was granted anyway. One expert quoted in the story called that decision “incomprehensible”.

The same report covers 1xBet and other operators. These are findings from documents as the journalists read them. If you play at Stake, our Stake review covers what we tested ourselves.

The arrest in Frankfurt

On 8 September 2026 more than 100 officers searched 11 properties, mostly in Frankfurt and the Rhine-Main area. The Frankfurt prosecutor arrested the main suspect and froze assets worth about €82 million. Luxury cars were seized and bank accounts were frozen.

Prosecutors say five people offered online gambling in Germany without a German licence since at least July 2021. They put the stakes at about €5.86 billion up to the end of 2023, and the unpaid tax for 2024 alone at about €77.6 million.

The prosecutor did not name the suspect. On 22 September Wittmann published a story that identifies him as Thomas Kalman, whom she names as the owner of Platincasino. Her link comes mainly from Malta Gaming Authority papers. On 17 September the German gambling regulator welcomed the arrest and warned players about Platincasino by name. Kalman’s lawyer told Wittmann the accusations are baseless. He is presumed innocent.

Some industry Telegram channels say the timing is no coincidence. They claim the journalists passed their files to the prosecutor before going public. We have seen no evidence of that. The prosecutor says it had investigated in secret for more than three years. That is longer than the hack has existed.

What the regulator said

The CGA did not dispute that it granted licences while questions about ownership were still open. It said the sector is in a transition period. Curaçao passed a new gambling law in 2024, and companies were given time to meet the rules step by step.

Critics in the story were not convinced. The head of a Dutch gambling trade group said the new law appears to be “failing miserably”.

Where to read the investigation

All stories and the document search are collected on the project site casinosecrets.lol. There is no point hiding the address. It has already gone round Telegram channels, social networks and the international press.

The main English story is on ftm.eu, and the Dutch version is on ftm.nl. Wittmann describes how she got in, in German, on her blog.

We do not repost any of the documents here. They hold passports and private papers of real people.

What it means for you

  • Your account. Nothing in the reporting points to player data. Change your password if you want peace of mind, and turn on two factor login.
  • The licence badge. A Curaçao licence shows that a company filed papers with the regulator. The leak shows the regulator did not always know who stood behind them. Treat the badge as a starting point.
  • Payouts. Start with a small deposit and make a small withdrawal early. This is how we test every house, as our review method explains.
  • Balance. Keep only the money you play with on the site. Move the rest to your own wallet.

Alex is a Duel partner, as our money page explains. Duel is not named in the reporting we read. The view at the top of this post is my personal opinion. The facts below it come from published reports and official statements, and they are attributed.

FAQ

Was my player account leaked?

None of the reports we read says so. The files described are licence papers of companies and their owners. We will update this answer if that changes.

Is this new news?

No. Follow the Money published it on 22 September 2026. We are writing about it later, but we could not skip it. Many houses on our list hold a Curaçao licence.

Where can I read the original investigation?

All stories are collected on casinosecrets.lol. The main story is on ftm.eu in English and ftm.nl in Dutch. Wittmann’s own account is on her blog in German. The links are in the section above.

Was someone arrested because of the leak?

One man was arrested in Frankfurt on 8 September, two weeks before the stories came out. Reporters link him to Platincasino. The prosecutor says its own probe ran for more than three years, and nobody has shown that the leak led to the arrest.

Should I stop playing at Curaçao casinos?

That is your choice. The reporting we read is about ownership and licensing. Check payouts with a small withdrawal first, wherever you play.

Gambling is for adults only and can become addictive. Play only with money you can afford to lose, and read our responsible gambling guide if it stops being fun.

Reader desk

Comments

Played at this casino, spotted a mistake or have a question? Write it here. Alex reads every comment before it goes live.

Be the first to comment

Your email is never shown. Comments are checked by hand before they appear. Links and promo codes are removed.

18+ only. By posting you agree to our terms and privacy policy.

All posts