Brightly painted waterfront houses along a harbour under a blue sky with white clouds

Analysis · Law and licensing

Curacao Gaming Authority hack: what the regulator confirmed and what it means for licence checks

Published 2026-09-28By the CryptoGuardz Register Desk5 min read7 sources

Photo: Cole Marshall / Unsplash

In short, from the documents

What did the Curacao Gaming Authority confirm about the hack?

The Curacao Gaming Authority confirmed on 17 and 22 September 2026 that its licensing portal was accessed from December 2025 to September 2026 under a false identity. It has not confirmed what was taken. Eight of the fourteen register operators hold its licences.

Piece published 2026-09-28Reviewed by CryptoGuardz Register Desk, editorial desk

The Curacao Gaming Authority (CGA) confirmed on 22 September 2026 that an outsider had access to its online licensing portal from December 2025 until September 2026, using an account registered under a false identity. That is roughly nine months inside the system that holds operators' licence applications. The regulator has not said what was taken, and says it "will not repeat figures it cannot verify".

Eight of the fourteen crypto casinos on the register hold CGA licences. Five of those eight show a registry status of "Assessment in progress" on a term that had already ended when the registry was read on 2 September.

What did the Curacao Gaming Authority confirm?

Three things, across two statements. On 17 September it said it had "identified unauthorized access to its online gaming portal", that the access was contained and its source identified, and that the investigation had "not yet established the full scope of the incident". On 22 September it went further:

Access was obtained through the customer-facing part of the licensing portal, using an account registered in December 2025 under a false identity.

CGA, Follow-up on unauthorized access to the CGA online gaming portal, 22 September 2026

The same statement says a German security researcher's public claims to have extracted operator data and internal documents are "consistent with its internal investigation", and that the CGA "will pursue reporting of this event to the relevant Authorities". The 17 September statement says the investigation had not identified "any compromise of the Authority's core technical infrastructure".

What was leaked from the Curacao licensing portal?

The regulator does not say. The figures in circulation come from the press. PlayUSA and Follow the Money report files covering about 650 licensed companies and about 800 owners, including licence applications, regulatory assessments, passports and tax returns. The CGA's answer to those figures is the line quoted above. They are not verified here.

Bundles of network cables running into rows of server racks — Illustration: server racks and cabling. The regulator has not said what was taken; the section sets out the press figures and why this page does not use the leaked files. Photo: Taylor Vick / Unsplash

This piece does not use the leaked files and does not name any individual from them. A leaked licence application is not a primary document this register can cite, because nobody can confirm it is complete, current or unaltered. The Curacao Online Gaming Association, which represents licensees, has objected to the sharing of "personal information belonging to entrepreneurs", according to the Curacao Chronicle.

Which casinos on the register are Curacao-licensed?

Eight. Seven were read from the CGA's own registry PDF of 31 August 2026 on 2 September 2026, and Thunderpick from the Gaming Control Board licensee page the same day.

Operator	Licence	Registry status	Term end
BetFury	OGL/2024/1494/0942	Assessment in progress	2026-07-31
Cloudbet	OGL/2024/328/0599	Assessment in progress	2026-05-23
Jackbit	OGL/2024/1562/1139	Assessment in progress	2026-07-23
Stake	OGL/2024/1451/0918	Assessment in progress	2026-06-09
Thunderpick	OGL/2024/677/0722	Assessment in progress	2026-06-04
Roobet	OGL/2024/687/0427	Indefinite	not applicable
Shuffle	OGL/2024/1337/0628	Indefinite	not applicable
Sportsbet.io	OGL/2023/110/0072	Active	no data

None of the eight has been named by the CGA in connection with the breach. Follow the Money's reporting discusses Stake's ownership filings; that reporting rests on the leaked files and is not repeated here.

What does the hack mean for a player's money?

Directly, nothing yet. The CGA's statements concern operator and applicant data on the licensing portal, not player accounts or player funds, and no player data is mentioned in either statement. Where individuals' data may have been affected, the CGA says "those parties will be notified directly".

Indirectly, it bears on the one check a player can make before depositing: looking the licence up. The registry PDF and the certificate portal are still the documents the register cites, and nothing in the CGA's statements says either was altered. The weakness they already had is unchanged. For Stake, the two disagree, as is Stake legit sets out. Five of the eight above show a term that had ended before the registry was read.

The 22 September statement also defends the licensing process in a sentence that is hard to read as reassurance:

This does not mean that there were still some pending matters to address by the licensed operators and followed up accordingly by the CGA.

CGA, Follow-up on unauthorized access to the CGA online gaming portal, 22 September 2026

Read literally, the sentence denies the thing it appears to concede. Either way, the registry already shows five of the eight as "Assessment in progress". The Curacao licence status tracker keeps that column current, and the licence directory covers the other issuers.

What this does not show

Whether any register operator's files were among those accessed is not verified. The owner and company counts are press figures. No player data exposure has been reported by the CGA. If a registry status changes, the change goes in the public log.

Quick answers

Was the Curacao Gaming Authority hacked?

Yes. The CGA confirmed on 22 September 2026 that its licensing portal was accessed from December 2025 to September 2026 through an account registered under a false identity.

What data was leaked in the Curacao hack?

The CGA has not said. Press reports cite about 650 companies and 800 owners; the CGA says it will not repeat figures it cannot verify.

Is my crypto casino account affected by the Curacao leak?

Neither CGA statement mentions player accounts or player funds. The CGA says affected individuals will be notified directly.

Which crypto casinos have a Curacao licence?

Eight of the fourteen on the register, listed above with their registry status. The Curacao licence status tracker has the detail.

Where can I get help with gambling?

Gambling Therapy offers free international support at gamblingtherapy.org, and more options are on the responsible gambling page.

More analysis

2026-10-02Stake banned in Nigeria: what the Lagos regulator actually published and what Stake's terms sayThe Lagos State Lotteries and Gaming Authority's own website lists Medium Rara NV, trading as Stake.com, at number 17 of 44 on its list of illegal gaming companies. The joint notice declaring Stake unlawful in 24 states circulated on LinkedIn and in trade press and was not on the regulator's site on 2 October 2026. Stake's terms list 45 prohibited jurisdictions, and Nigeria is not one.2026-09-28Stake blocked in Ireland: what the regulator and the terms say about player balancesStake stopped serving Irish players in mid-September 2026 after contact from the Gambling Regulatory Authority of Ireland, which says it wants Irish players' deposits refunded. The regulator's own notice says casino licence applications open in 2027 and 2028.2026-09-28What the terms say about crypto casinos in Canada, and why Ontario is the clause to readOntario's regulated market verifies identity before an account is created, and no operator on this register is part of it. Three of the fourteen name Ontario in their own restricted list, and the consequence for playing from a restricted place is written into the contract.2026-09-28Sending crypto from an exchange straight to a casino: what the exchange can doOf twelve exchanges on the register, OKX, Bitget and MEXC prohibit gambling transfers outright, OKX and Gate attach a freeze or confiscation power to their gambling clause, Coinbase can claw back a transfer it links to prohibited use, and Binance, Crypto.com and HTX say nothing. Routing through a self-custody wallet moves the balance out of reach of those clauses; it does not change what they say.2026-09-28Crypto cards and gambling: what each card's own terms say about casinosTwo of fourteen cards prohibit gambling in a document the issuer publishes, one treats it as a cash advance, and Revolut's block works on merchant codes it admits can be dodged. RedotPay's terms name no gambling rule.2026-09-28Drake and Adin Ross Stake lawsuit: what the complaint alleged and why it was pausedA Virginia class action accusing Stake.us, Drake and Adin Ross of running an illegal casino and moving money through tips was stayed on 30 July 2026. Stake.us's terms bind players to individual arbitration unless they opted out within 30 days.

Sources

About this piece

Compiled by the CryptoGuardz register team from the sources listed above. Research and drafting are AI-assisted and reviewed by a named editor before publication. Nothing here is a recommendation to gamble. If a figure or a reading is wrong, tell us and the correction is logged in public.