A massive data leak from the Curaçao Gaming Authority (CGA) has pulled back the curtain on one of the most secretive corners of the global gambling industry. Published under the banner Casino Secrets, the investigation draws on more than 84,000 documents and over 2 TB of data covering more than 1,000 iGaming companies. Since 22 September 2026, media outlets across Europe, Australia and Brazil have used the files to name the people behind offshore casinos, many of which are accused of targeting players in countries where they have no right to operate.

The leak also arrives at a moment when the industry is debating whether technology, from blockchain registries to provably fair games, could make gambling more transparent. The Casino Secrets files suggest that the real problem is not the dice, but who owns the table.

What Is the Casino Secrets Investigation?

Casino Secrets is a cross-border journalistic project led by German independent journalist Lilith Wittmann, working alongside outlets including Follow the Money, NRK, SVT and NDR. Its public hub, curacaofiles.com, lets anyone search company names and casino domains against the leaked records.

A tiny island with 8,000 casino domains

Curaçao, a Dutch Caribbean island of roughly 160,000 people, hosts more than 8,000 licensed casino domains. Over two decades it has become a global gambling hub by issuing online licences that almost no other government officially recognises. Strikingly, these licences do not even allow their holders to offer gambling legally in Curaçao itself. Yet, according to the investigators, they have helped fuel an illegal iGaming market worth billions worldwide.

How the data was obtained

The documents were extracted from the CGA's internal IT systems. The team says this was done on the grounds of overriding public interest, after other journalistic methods had been exhausted. Wittmann has written that she had access to the authority's systems for nine months. The material was later combined with documents from the Malta Gaming Authority and with public company registers in Malta, Cyprus, Gibraltar and Curaçao.

The method is controversial. Critics and regulators describe it as hacking, while the journalists argue that the public has a right to know who profits from licences that enable illegal gambling abroad.

What the records contain

The files include licence applications, ownership declarations, domain lists and correspondence between the regulator and the offshore management companies that sit between casino operators and the state. For the first time, they show how licences were assessed and who was approved.

Key Revelations From the Leak

The first wave of reporting focused on a simple question: who owns the casinos? The answers range from little-known shell companies to wealthy businesspeople and a former politician.

Licences granted despite red flags

According to Follow the Money, the files show that Curaçao's regulator overlooked warning signs and granted licences even when questions about ownership remained unanswered. Financial crime experts quoted in the reporting warn that this level of secrecy can open the door to money laundering and organised crime.

Platincasino and Germany's biggest illegal gambling case

The most explosive thread runs to Germany. Reporting by Wittmann, Follow the Money, SVT, NDR and NRK links Platincasino and its owner, Thomas Kalman, to an illegal online gambling probe valued at €5.86 billion. Internal documents point to a network of companies in Malta and Curaçao, and Wittmann reports an alleged tax gap of around €250 million. Lovin Malta reported that the case is connected to an arrest in Frankfurt. Kalman's lawyer has responded to the allegations, and no court has ruled on the claims.

Politicians, billionaires and football sponsors

The leak has produced headlines far beyond Germany:

  • Australia: ABC reported that former federal minister De-Anne Kelly is named in the files as a co-founder of the offshore LuckyBet casino.
  • Norway: NRK traced a stake in ComeOn's Curaçao operation to billionaire Morten Klein.
  • England: Josimar questioned whether the person recorded as the owner of 8Xbet, a prominent Premier League betting sponsor, is the real figure behind the brand.
  • Berlin: Wittmann examined how closely software supplier Softswiss is tied to companies running hundreds of casinos that operate illegally in some markets.
  • Brazil and Austria: Folha and JETZT followed local links to influencer marketing and Austrian backers.

The Guardian summed up the stakes, reporting that the files could have major consequences for online casinos accused of illegally targeting consumers.

Could Blockchain Fix Online Gambling's Trust Problem?

Scandals like Casino Secrets regularly revive one argument in the crypto community: if casinos ran on public blockchains, players would not need to trust hidden operators at all. Many crypto-focused casinos have themselves relied on Curaçao licences, so the debate is far from academic.

How smart contracts work in online gambling

To understand how smart contracts work in online gambling, think of a vending machine written in code. A smart contract is a program stored on a blockchain that runs exactly as written. A player sends a stake to the contract, the contract determines the outcome under fixed rules, and it pays out automatically if the player wins. The rules, the house edge and the contract's balance are visible to anyone who inspects the chain.

Provably fair gambling using Ethereum smart contracts

Provably fair gambling using Ethereum smart contracts goes a step further. The outcome is derived from inputs that neither side can secretly manipulate, often a combination of a player seed, a casino seed revealed after the bet, and a verifiable random function. After each round, players can recompute the result and confirm that the game was not rigged.

Smart contract casinos with instant payouts

One of the main selling points of smart contract casinos with instant payouts is that winnings leave the contract as soon as a round settles. There is no withdrawal queue, no manual review and no opportunity for an operator to quietly freeze a balance, which is a frequent complaint about offshore sites.

The limits of blockchain technology to prevent casino fraud

Still, blockchain technology to prevent casino fraud only solves part of the problem the leak exposes. A smart contract can prove that a single game is fair. It cannot reveal who controls the contract, where the profits flow, or whether the operator is allowed to serve players in Germany, Norway or Australia. Wallets can be as anonymous as shell companies. The Casino Secrets files show that the core issue is ownership and accountability, and code alone cannot replace licensing, beneficial ownership registers and enforcement.

The publication has already triggered a legal battle. The Malta Gaming Authority is suing Wittmann over her use of its documents. She says the case has cost her more than €15,000 in legal fees, but that the authority has so far lost on most issues in the German civil proceedings, so she can keep reporting on the Maltese data.

Pressure on Curaçao and Malta

The revelations land as Curaçao tries to rebuild the credibility of its licensing regime. Local outlet Curaçao Chronicle noted that the island's iGaming sector is once again under international scrutiny. Regulators in countries where these casinos take bets without a local licence now have documents that name owners, service providers and corporate structures.

What players should take away

For players, the lesson is practical. A Curaçao licence badge on a casino website says little about who runs it or whether it may legally serve your country. Checking your national regulator's list of approved operators remains the safest step. Whether the next generation of gambling runs on Ethereum or on traditional servers, transparency about ownership is what Casino Secrets shows is missing.