Poker Sites Received Warnings About Paul Gregg Accounts Before Scandal Surfaced
CoinPoker had blocked and refunded an account registered to Gregg, while GGPoker received a September anomaly review that stopped short of alleging cheating.
Online poker sites had received warnings about suspicious accounts linked to the name Paul Gregg before the recent superuser allegations became public. One operator had already blocked an account registered in that name, seized about $100,000 and returned money to affected players, while a separate September analysis asked GGPoker to examine unusual play by its Paul Gregg account.
CoinPoker blocked the account using the nickname Europe about two years earlier, according to reporting cited by PokerNews and SpadePoker. The account was registered in Paul Gregg’s name, PokerOrg reported. Patrick Leonard said it was caught after playing on the site for less than a week, while Mario Mosbock described a security-team detection and a $100,000 confiscation. The funds were redistributed to affected players.
The reported timing is not wholly consistent. Leonard separately said the account was caught around a year before the latest reports, while other accounts place the CoinPoker action at roughly two years earlier. In either case, the reports indicate that concerns about accounts tied to the name predated the public exposure of the wider incident.
Patrick Howard submitted an anomaly review to GGPoker in early September after examining 32,780 hands involving Paul Gregg. The document, prepared Sept. 1, did not accuse Gregg of cheating or claim proof of misconduct. Instead, it requested further investigation and recommended using later hands to test whether the patterns persisted beyond variance. GGPoker later contacted Howard about the investigation.
Howard’s sample showed a global win rate of 13.9 big blinds per 100 hands and unusual results in large pots. Gregg won 59 of 78 deep-stack river showdowns after betting or raising the river, a 75.6% rate compared with 58.2% among comparable regulars. More than half of the account’s profit came from pots larger than 150 big blinds, where the sample showed a gain of 2,497 big blinds.
Around 100 players had raised suspicions about the accounts over several years, according to the reports. Leonard said players saw win rates that were likely impossible and showdowns that did not make sense, although the available reporting does not establish that every reported account was operated by the same person or group.
As covered last week, the broader allegations involve compromised third-party poker software that allowed attackers to remotely view targeted players’ screens and hole cards. Jurojin said the operation was highly targeted rather than a mass attack, while reporting has put the number of potentially affected high-stakes players at roughly 10 to 30.
Ignacio Moron estimated that he lost between $100,000 and $200,000 to the Paul Gregg account, including $60,000 in about 15 minutes. He said CoinPoker refunded approximately $60,000 after banning Europe, and recalled an April 2024 conversation in which a player warned that Gregg’s behavior appeared to be that of a superuser.
