CasinoSecrets: The Curacao Leak Behind a Global Offshore Gambling Investigation

What is CasinoSecrets?

The files come from Lilith Wittmann, a Berlin-based security researcher and journalist. According to Follow the Money, she registered on the Curaçao Gaming Authority's licensing portal in December 2025 using the name of a trust-office manager known to the regulator, but her own email address, and was granted access within days. ^[1] The regulator says the account was registered under a false identity and that access continued until September 2026, when it was identified and ended. It calls the incident a serious breach under Curacao law and says it will report it to the relevant authorities. ^[2]

Wittmann shared the material with Follow the Money in the Netherlands, NRK in Norway, NDR in Germany, Jetzt in Austria and SVT in Sweden. Follow the Money says it used only the documents obtained in December 2025, before it knew of the breach, and checked ownership records by hand against company structures, disclosure forms and the regulator's own recommendations. Its analysis covers the 646 companies that held a licence at that point and identifies about 800 owners. ^[1]

On 23 September the consortium published more than 40,000 documents in a searchable database. The database states that appearing in it "does not imply illegal or improper conduct": it contains the licensing files of ordinary licensees as well as the companies that feature in the reporting. ^[3]

Which companies are named, and what is alleged

• Stake (Medium Rare N.V.). On paper, the crypto casino is owned by its chief executive, who declared assets of more than $1 billion. Follow the Money reports that regulator officials questioned whether he was the sole owner after finding loans and payments worth tens and sometimes hundreds of millions of dollars to companies and individuals linked to Stake's publicly known founders, who were not named in the application. The licence was granted. ^[1] The regulator's public register now lists Medium Rare as "assessment in progress", according to Bitcoin.com News. ^[4]
• 1xBet (Caecus N.V.). Assessors suspected the brand had "multiple owners" and asked the listed owner about his relationship with the three Russians publicly identified as 1xBet's founders. The licence was granted in 2024 without those answers. 1xBet and its representative in Curacao said they could not respond to "assumptions" based on documents they had not seen. ^[1]
• Qbet (Novatech Solutions N.V.). The Dutch Gambling Authority fined the operator nearly €25 million in March for offering gambling illegally in the Netherlands; Novatech has appealed. The files name a tech manager in Manila as its ultimate beneficial owner. Neither Novatech nor Qbet responded to Follow the Money. ^[1]
• Blaze (Prolific Trade N.V.). The Brazilian-facing site's two owners declared assets of €800 million and €500 million to the regulator. Blaze faced complaints in Brazil in 2023 over unpaid winnings, which it denied; the owners did not answer questions. ^[1]
• Platincasino and the SoftSwiss network. The German-facing Platincasino is linked to the Frankfurt investigation into alleged illegal gambling worth €5.86 billion in stakes (see below). Wittmann also maps a network of at least 55 companies around the software group SoftSwiss, which she links to hundreds of casino domains. ^[5] In a lawyer's letter quoted by NDR's STRG_F, SoftSwiss said it operates no online casinos itself; the Curacao regulator told STRG_F that sharing a technology platform "does not convert separate licenced entities into a single regulatory network". ^[4]

What the files say about the regulator

The sharpest criticism concerns how some applications were handled. Follow the Money reports that assessors repeatedly identified problems, such as unclear owners, missing source-of-wealth information or signs that a company was active in countries where it had no licence, yet still concluded that "the licence may be granted", often on condition that more information would follow. Marcel Pheijffer, a professor of forensic accountancy at Nyenrode Business University, told the outlet that "in the Dutch context, that approach would not be possible". ^[1]

The Curaçao Gaming Authority did not dispute that some licences were granted with questions still open. It said the sector is in a transition period after the 2024 reform, which for the first time put online operators under direct government supervision, and that companies are being given time to meet the new requirements step by step. It also said that telling active targeting of a market apart from merely accepting customers from it is "complex". ^[1] In its statement of 22 September it added that it has followed "robust internal procedures" since 2024 and that judging its licensing from separate documents, without the full context of each application, is not prudent. ^[2]

The Platincasino connection

For German readers the most concrete case is Platincasino. According to Wittmann, the casino held a Maltese licence from 2017 through Red Rhino Limited, and documents filed with the Malta Gaming Authority name a Frankfurt businessman as that company's sole ultimate beneficial owner. ^[6] Germany's regulator fined Red Rhino €50,000 in 2023 because German players could still play on Platincasino.com, Lovin Malta reports. ^[7]

In 2023 the brand, its domains and its player database were sold to Latiform B.V. in Curacao for €6 million, according to Latiform's accounts as cited by Wittmann. She questions how much changed beyond the formal owner, pointing to a customer-support login run through the Malta-based brand The Multiple, a renamed social-media page and staff-party videos from 2024 and 2026. ^[6] These are investigative findings, not a court ruling that the sale was a sham.

On 8 September more than 100 officers searched 11 properties, mainly in Frankfurt, and arrested a main suspect. Prosecutors say five people offered online gambling without a German licence from at least July 2021, processing about €5.86 billion in stakes by the end of 2023, and estimate the tax loss for 2024 alone at about €77.6 million. ^[7] Prosecutors have not named the suspects or the website, but in its statement on the investigation the German regulator, the GGL, explicitly warned consumers against illegal offers "such as Platincasino". ^[8] Wittmann reports that the man arrested is the businessman she links to Red Rhino; through his lawyer, he has called the allegations baseless. ^[6] Our report on the German investigation covers the raids themselves.

Wittmann also estimates that about €250 million in German gambling tax went unpaid between 2023 and 2025. That is a journalistic calculation, based on the assumption that 85% of players were German and on stakes inferred from reported player losses. It is not a tax assessment or a court finding. ^[9] The Malta Gaming Authority told The Shift that it does not accept the description of cross-border activity by its licensees as "illegal gambling". ^[9]

The Berlin court case

The Malta Gaming Authority, which Wittmann says she also accessed in March 2026, went to court in Berlin. In May the Berlin Regional Court granted the authority an interim injunction over statements Wittmann had made on social media and the alleged unauthorised download of large amounts of data. Wittmann called the case an attempt to silence her and said she would object. ^[10]

On 25 September Wittmann posted the first page of a judgment and wrote that she may keep using the documents she obtained and keep describing the MGA as an "organised crime enablement scheme", but may not access its systems again. ^[11] The full judgment has not been published, and everything known about the outcome comes from Wittmann herself. It would be wrong to read it as a court finding that the MGA is a criminal organisation.

What it means for UK players

A Curacao licence has never been permission to offer gambling in Great Britain; that requires a Gambling Commission licence. The leak underlines how little a licence logo on its own tells a player about who is behind a site. Before depositing, check which regulator licenses the operator for your market, who the operator is and how withdrawals and complaints work.

The case is separate from recent enforcement closer to home. In Manchester, police, the Gambling Commission and the city council raided premises suspected of illegal gambling, arresting four people and seizing more than £20,000 in cash. ^[12] The two investigations are unrelated, but both show regulators moving against unlicensed gambling on several fronts at once.

What remains unproven

Nobody named in the reporting has been convicted. The Frankfurt investigation is ongoing and no charges have been announced. The ownership questions around Stake and 1xBet come from the regulator's own internal assessments, which the companies have not seen or have declined to discuss. The €250 million figure is an estimate, the Berlin judgment has not been published, and the Curacao regulator has not yet said what exactly was taken from its systems. ^[2]

If gambling is causing you problems, the blocking and self-exclusion tools are the quickest way to put distance between you and the next bet.