What the tool actually does

The replayer works entirely browser side, pulling from ACR’s own completed tournament data and reconstructing the final table hand by hand. Every seat’s hole cards are shown for every hand, not just the hands that reached showdown, which is what makes the tool genuinely useful for studying decision making rather than just watching results. A viewer can see exactly what a player was holding when they three bet, or exactly what a big fold actually saved them from, information that a standard hand history export deliberately omits for hands that ended before showdown.

Why this is not the leak this site usually writes about

This is worth being explicit about, given how much of this site’s security coverage is specifically about hole cards leaking somewhere they should not be. The two situations are structurally opposite. A hole card leak is unauthorized access to hidden information during a hand that is still live, information a player has a legitimate expectation of privacy over because the hand has not concluded and the stakes are still real. ACR’s replayer only covers completed tournaments where the hands are already finished, the money has already been paid out, and the players involved have implicitly accepted that a final table, by its nature as a milestone tournament result, may be documented and studied publicly afterward.

Revealing hole cards after the fact, for a hand that is already over, is exactly the kind of legitimate showdown-equivalent disclosure the hole card leak discussions on this site have consistently described as the correct time for that information to become public. ACR’s tool is a good illustration of the same principle from the other direction: it is not a security failure that hidden information became visible, it is a deliberate content feature built around information that had already stopped being hidden by the time anyone could access it.

Why a tool like this is a reasonable thing to build

Final table replays with full information are standard content in poker media generally, live streamed final tables with hole cards revealed to the audience are one of the most common formats in the sport, and this tool essentially extends that same convention to ACR’s own online tournament results without requiring a broadcast production. For students of the game, having a searchable archive of completed final tables to review, without needing to have watched them live, is a genuinely useful study resource, and building it as a no login, no download browser tool removes any friction between wanting to review a hand and actually being able to.

The takeaway

Not every instance of hole cards becoming visible is a security story, and this is a useful reminder of that distinction. The mechanism matters. Hidden information reaching a browser during a live hand, through the channels discussed elsewhere on this site, is a genuine problem. The same information becoming visible for a hand that concluded, in a tool built specifically for that purpose, is simply how poker content has always worked.

Growing the ambassador roster

CoinPoker added three new ambassadors in February 2026, according to Card Player’s coverage: Johan “YoH Viral” Guilbert, Mariano Grandoli, and Brantzen Wong, alongside Hustler Casino Live regular Nik Airball. The roster also includes Mario Mosböck, a three time champion of the Triton Series, high roller regular Alejandro Lococo, and, as of June 2026, Lukas “Robin Poker” Robinson, who joined as a partner and content creator rather than a purely competitive ambassador.

This is a fairly standard playbook for a challenger platform: recruiting recognizable names from popular poker content, live stream personalities in particular, to bring an existing audience directly to the platform rather than relying purely on paid acquisition.

Becoming an official Triton Series partner

CoinPoker’s more significant move was becoming an official partner of the Triton Montenegro Series, one of the most prestigious super high roller live tour stops in poker, running from May 13 through May 28, 2026 at the Maestral Resort & Casino. As part of the partnership, CoinPoker rolled out a Road to Triton promotion, giving away a fully covered $25,000 buy-in package to an upcoming Triton Super High Roller event in Jeju, directly connecting an online platform’s promotional budget to a genuine live super high roller circuit stop most recreational players would otherwise have no realistic path into.

Attaching a crypto native platform’s name to Triton specifically is a notable brand association, since Triton events are widely regarded as the most exclusive and highest stakes live series in the game, frequented by some of the best known professionals and high net worth recreational players in the world.

Presenting sponsor of High Stakes Poker’s live return

CoinPoker’s highest profile placement to date was being named presenting sponsor of a week long live return of High Stakes Poker on PokerGO, running August 25 through 31, 2026, according to Esports News UK. The broadcast featured well known names including Andrew Robl, Alejandro Lococo, and Rick Salomon, putting the CoinPoker brand in front of one of the most consistently watched recurring poker broadcasts on PokerGO for a full week of coverage.

Expanding beyond poker entirely

CoinPoker’s marketing has also reached outside poker specifically. The platform previously became a regional sponsor of Argentina’s national football team, a partnership that predates this year’s poker specific push and reflects a broader strategy of using mainstream sports sponsorship to build brand recognition with an audience that may have no prior connection to online poker at all.

Reading the two CoinPoker stories together

Sponsorship spending and certification transparency are two entirely separate questions, and neither answers the other. A platform can run a genuinely well funded marketing operation, with real ambassadors, a real Triton partnership, and a real presenting sponsorship on a major broadcast, while still leaving basic, checkable specifics like a named testing lab and a certificate number off its own security page. Evaluating a platform on marketing reach alone, or dismissing it on the certification gap alone, both miss half of what is actually going on with the site in 2026.

Anonymous tables as the whole identity

Where sites like PokerStars and GGPoker build their reputation on scale, Ignition has built its reputation almost entirely around Anonymous Tables, its branded implementation of randomized display names discussed more generally elsewhere on this site. Every player at an Ignition table appears under a temporary, rotating label rather than a persistent username, which means no HUD software, no opponent database, and no way to research a specific player’s history before sitting down.

This is a deliberate positioning choice aimed squarely at recreational players who do not want to face regulars armed with thousands of tracked hands of reads against them. It comes at a real cost for serious grinders who rely on data driven adjustments, which is part of why Ignition’s player pool skews more casual than data focused compared to tracked pool competitors.

Crypto first cashier

Ignition’s deposit and withdrawal options lean heavily toward cryptocurrency, particularly Bitcoin, and crypto withdrawals are typically the fastest option available, often settling within a day once approved, considerably quicker than the card or check by courier options the site also offers as legacy alternatives. This fits a broader pattern common among offshore focused US operators, where crypto rails offer both speed and a payment channel that does not depend on US card networks that are often reluctant to process offshore gambling transactions in the first place.

Jackpot Poker and softer field positioning

Ignition runs its own fast fold variant, generally marketed under a jackpot themed name, offering the rapid, anonymous, high hands per hour format that has become a standard feature across most modern platforms. Combined with the anonymous table structure across regular cash games too, the overall positioning is consistently softer field over bigger traffic, a tradeoff that suits recreational and casual grinding players considerably better than it suits full time high volume professionals.

Smaller pool, real limitation

The honest tradeoff of Ignition’s model is traffic. A smaller US facing player base means fewer tables running at any given time outside peak hours, less depth at higher stakes, and a tournament schedule considerably thinner than what the largest global rooms offer. Players whose priority is always finding action at any stake at any hour will find Ignition noticeably more limited than PokerStars or GGPoker in this specific respect.

Verdict

Ignition is not trying to be everything to everyone, and its anonymous table structure combined with a crypto native cashier makes it a genuinely distinct product rather than another traffic focused site with a different color scheme. For a recreational player who values a soft field and fast crypto payouts over sheer table count, it remains one of the more coherent offshore options built around those specific priorities.

WSOP.com’s regulated bracelet series

Earlier this year, WSOP.com ran its own online bracelet series, described in detail in Caesars Entertainment’s official announcement and PokerNews’ coverage. That series ran from May 30 through July 14, 2026, featuring 30 gold bracelet events with $7 million guaranteed across the schedule, exclusively available to players physically located in Nevada, New Jersey, Michigan, or Pennsylvania, the four states where WSOP.com currently holds a regulated license. It also awarded 50 seats to the $10,000 buy-in WSOP Main Event in Las Vegas through two 25 seat scramble tournaments, directly connecting the online series to the live event.

GGPoker’s international bracelet series

A separate, much larger series, also branded WSOP Online, is running from August 16 through September 29, 2026, this time on GGPoker rather than WSOP.com, as described in PokerNews’ coverage of the schedule. This version features 33 gold bracelet events and more than $66 million in guaranteed prize money, with a $5,000 buy-in Main Event guaranteeing $25 million on its own, structured across 19 separate Day 1 starting flights. GGPoker has also committed $5 million to side promotions during the series, including a Super Pass Bonus that gives every bracelet winner a $30,000 direct entry into the Super Main Event at WSOP Paradise.

Why two separate series exist under one brand

The split exists because of how WSOP licenses its brand across different markets. WSOP.com operates under Caesars Entertainment’s license specifically within regulated US states, where online poker legality is determined state by state and interstate liquidity is limited to states that have signed the relevant compacts. GGPoker holds the rights to run WSOP branded online events internationally, outside the US regulated framework entirely, which is why its version of the series can draw on a vastly larger global player pool and correspondingly larger guarantees. The two operators are not competing for the same players. They are running functionally separate products that happen to share a famous name and a bracelet.

Why the distinction actually matters to a player

If you are a US player in one of the four eligible states, only the WSOP.com version was ever available to you, and it has already concluded for 2026. If you are an international player, only the GGPoker version is relevant, and it is running now through the end of September. Coverage that refers simply to “WSOP Online” without specifying which platform can easily leave a reader looking for a bracelet event on the wrong site entirely, or assuming a series has already ended when the much larger international version is still actively running.

What actually launched

According to PokerNews’ coverage of the announcement, UK based PokerStars customers began migrating to the Betfair platform under the new branding “PokerStars on Betfair.” Rather than a simple rebrand, this is a genuine platform migration: Betfair Poker itself moved off the iPoker Network, which it had used previously, and onto what Flutter is calling the PokerStars Network, or PSN, running on PokerStars’ own long standing software.

Mike Woodbridge, Chief Commercial Officer for PokerStars, described the reasoning directly: “We want to do something about that, so we’re moving to a different model with the aim of improving liquidity and player pools.” Betfair’s Managing Director, Kim Daly, called the move “a powerful moment for the industry,” framing it as “uniting two category-transformers.”

What actually changes for a player

For UK customers specifically, the practical change is which client they log into, Betfair’s rather than PokerStars’ own standalone app, while the underlying poker experience stays connected to PokerStars’ existing global player pool. Sunday Million, SCOOP, WCOOP, and Spin & Go tournaments remain accessible exactly as before, and qualification paths into live events like the European Poker Tour are unaffected. Players outside the UK see no change at all from this specific migration.

Why this counts as a real structural shift

The significance here is not really about Betfair specifically. It is the model being introduced: rather than operating multiple separate branded poker platforms, each with its own software stack and its own separately maintained liquidity pool, Flutter is consolidating its portfolio of brands onto a single shared network built on PokerStars’ software, with Betfair simply the first brand to migrate. Paddy Power Poker and Sky Poker are both expected to follow the same path later in 2026, adopting PokerStars software rather than continuing to operate independently.

This mirrors a pattern already visible elsewhere in the industry, including at Entain, where partypoker’s European operations have been folded into the shared iPoker Network rather than continuing as a standalone platform. Fragmented player pools across multiple competing brands under the same parent company are an inefficiency that shared network models are increasingly being used to solve, at the cost of each individual brand’s software independence.

What to actually watch for

The stated goal, improved liquidity and player pools, is a real and measurable outcome to track over the coming months: does PokerStars on Betfair actually produce larger, more active tournament fields for UK players than the standalone Betfair Poker platform did on its own. If Paddy Power Poker and Sky Poker do migrate onto PSN as expected later in 2026, the practical effect will be a meaningfully larger combined UK facing player pool sitting behind PokerStars’ software specifically, which is a trend worth watching regardless of which of these brands a given player happens to use.

The claim versus what is actually published

CoinPoker markets its randomness as a decentralized, provably fair system built on a Fisher-Yates shuffle, and describes it as certified. According to a detailed review published on Pokerlume, however, when the platform’s public RNG page was checked on August 1, 2026, it did not link to a testing laboratory report naming the specific lab, a certificate number, an issue date, the software version covered, which games were in scope, or the underlying statistical test results. That is precisely the set of specifics a genuine, checkable certification is supposed to include, and their absence means the certification claim currently rests on CoinPoker’s own description rather than on independently verifiable documentation a player or researcher could confirm.

A security researcher’s concern in March 2026

Separately from the certification question, a researcher using the handle WolfSec0x0 raised a possible security concern following a major CoinPoker software update on March 3, 2026. CoinPoker’s stated response was that its initial internal assessment found no backend vulnerability and no risk to player funds, accounts, or core systems, and the researcher reportedly expressed satisfaction after further discussion with the team. It is worth being precise about what that resolution does and does not establish. No source code, exploit details, a full technical report, or an independent penetration test result accompanied the public account of this exchange, meaning the resolution is currently supported by attributed statements from both sides rather than by published, independently reviewable evidence.

The November 2024 hot wallet incident

CoinPoker also has an earlier, more concrete precedent worth noting. In November 2024, a platform controlled hot wallet, meaning a wallet the operator itself directly controls rather than one held individually by a player, was reportedly compromised for approximately $2 million, with the funds subsequently routed through a mixing service, a common technique for obscuring the destination of stolen cryptocurrency. The available reporting does not establish whether customer balances ultimately absorbed any of that loss, which is an important distinction, but it does confirm that a real, material breach of company controlled infrastructure occurred, independent of the more recent and less conclusively resolved March 2026 concern.

Why the gap between claim and evidence matters

None of this proves CoinPoker’s shuffle is unfair or that player funds are currently at risk. What it does show is a recurring pattern: strong, specific sounding claims, provably fair, certified, no backend vulnerability found, that are not consistently backed by independently verifiable documentation. A named laboratory, a certificate number, and a public test report are not difficult things for an operator to publish if they genuinely exist. Their absence on a platform’s own security page is not proof of wrongdoing, but it is a legitimate reason for a cautious player to treat marketing language about fairness and security as a claim to be verified rather than a guarantee to be taken at face value.

None of this is the whole picture of CoinPoker in 2026 either. The site has, separately, been spending real money on live tournament sponsorships and a growing ambassador roster, which is worth reading alongside this piece rather than in isolation.

The announcement

Per Flutter’s own press release and subsequent reporting, Peter Jackson will step down as Flutter’s Chief Executive Officer and as a Director of the Board on September 30, 2026, after roughly nine years in the role. Dan Taylor, currently President of Flutter and CEO of its International Division, will become the company’s next Group CEO effective October 1, 2026. Jackson is set to remain with the company as an advisor through the end of the year to support the handover.

Why the timing raised eyebrows

The transition was announced alongside Flutter’s second quarter 2026 financial results, which included weaker than expected performance in the company’s US business and a reduction to full year 2026 guidance. Flutter’s share price dropped by roughly 11 percent following the announcement, a reaction that reflects the market reading the leadership change and the guidance cut together rather than treating them as unrelated news arriving on the same day.

Who Dan Taylor actually is

Taylor is not an outside hire. He has led Flutter’s International division as CEO since 2020, and was promoted to President of that division in May 2026, shortly before his elevation to the top role. International operations, the part of Flutter’s business that includes PokerStars’ global poker product outside its US facing operations, is specifically the part of the company Taylor has run directly for several years, which is a meaningfully different profile than if Flutter had brought in an executive from an unrelated industry with no direct poker or international gaming background.

What this could plausibly mean for PokerStars specifically

A CEO transition at a holding company does not automatically translate into product level changes at any single brand underneath it, and Flutter has repeatedly emphasized continuity through this transition rather than a strategic overhaul. That said, two things are worth watching given Taylor’s background. First, a CEO who ran International operations directly is likely to have a more hands on understanding of PokerStars’ global poker business than a purely US market focused predecessor. Second, the guidance cut driving part of this transition centers specifically on US performance, which raises the more general industry question of whether continued investment gets weighted more heavily toward international liquidity, where PokerStars’ core poker product actually lives, relative to the US sports betting business the guidance cut was about.

The practical takeaway

Corporate leadership changes rarely produce immediate, visible effects at the table, and nothing here suggests any near term disruption to PokerStars’ poker product specifically. It is nonetheless a genuine data point for anyone trying to understand the broader financial pressures facing the company that funds PokerStars’ ongoing investment, tournament guarantees, and technology development, since a parent company under guidance pressure and mid leadership transition is operating under different constraints than one performing comfortably ahead of expectations.

Why PokerNow Is Structurally More Exposed

Traditional online poker clients, the kind used by PokerStars, GGPoker and other licensed real money operators, run as compiled desktop applications. They ship with obfuscated binaries, custom network protocols, kernel level anti tamper systems, and dedicated security teams whose entire job is closing exactly this kind of hole. PokerNow runs in the browser. That single design decision is the root of almost everything else in this article.

As of August 2026, numerous instances have circulated that Poker Now opponents’ hole-card information may be accessible through data transmitted during live play, including WebSocket traffic. Currently, there has been no communcation from PokerNow in response to thr recent wave of exploits. With sensitive card data being exposed to an unauthorised player in this way, a relatively experienced programmer analyses that traffic and exploit the flaw, making it a serious game-integrity and security issue that should be reported privately and addressed by the platform.

A browser is, by design, an inspectable environment. Every modern browser ships with a full set of developer tools built in and available to anyone, for free, with no special skill required beyond knowing where the menu is. Those tools let a user open the page’s underlying document structure, watch every request and response moving across the network in real time, inspect variables sitting in memory, and even attach a debugger that pauses the application’s own code mid execution. That is an enormous asset for web developers building and testing software. It is a serious liability for any application whose core mechanic depends on some players not being allowed to see information that other players have.

In other words, PokerNow is trying to run a game of hidden information on a platform whose defining feature is that nothing run on it is truly hidden from the person operating the machine. That tension is not a bug in the traditional sense. It is a mismatch between the security model poker requires and the security model a browser can actually provide without extraordinary additional effort.

The Technical Anatomy of a Hole Card Leak

At a conceptual level, real time browser based card games can leak hidden state through a small number of well understood channels. None of these require exotic hacking skill. Most require nothing more than opening developer tools and reading what is already sitting on the page. For PokerNow, hackers have had to gain access to much more than what is in the web coonsole. The sections below go into more detail on how each mechanism typically looks from an engineering standpoint, without providing a working method to reproduce them against a live table.

{ "seats": [
  { "id": "p1", "cards": ["5h","6d"], "visibleToMe": false },
  { "id": "p2", "cards": ["Ah","Kd"], "visibleToMe": true }
] }

How This Class of Bug Is Actually Found

It is worth being specific about what auditing for this looks like in practice, since the process itself illustrates why the underlying fix has to happen server side. A reviewer opens the browser’s built in network inspector before a hand starts, filters the traffic to WebSocket frames, and simply watches what arrives as the hand progresses. If a frame arriving before showdown contains card values for seats other than the reviewer’s own, that is the leak, independent of anything the interface is currently choosing to render. The interface is irrelevant to this test entirely. The only question that matters is what bytes crossed the network to that specific connection and when.

The same logic applies to memory inspection. A reviewer can pause execution with the debugger at a point in the code responsible for drawing the table, and inspect the objects available in scope at that moment. If hidden card values are present in any object reachable at that point, again independent of whether they are currently being drawn, the application has already failed the relevant security property. Passing this kind of review requires the server to have made the correct filtering decision before anything was transmitted, not the client to have made a correct display decision after receiving everything.

A Documented Case: The June 2024 Injection Vulnerability

This isn’t a purely theoretical category of bug. Security researcher Kevin Roleke documented a concrete example of exactly this kind of failure on PokerNow, disclosed on June 12, 2024.

The root cause was slightly different from the over-delivery pattern described above, but it lands in the same place: the browser ends up holding, and executing, more than it should. PokerNow sanitizes user-supplied text like display names in most places, but according to the writeup that sanitization was applied inconsistently across the codebase. Two spots stood out:

• Club admin approve and reject controls built their onclick handlers by concatenating a player’s username directly into JavaScript, e.g. onclick="club.approveWaitingUser('${this.club.id}', '${player.user_id}', '${player.username}')", which allowed code execution inside a username field despite a 14-character limit.
• The private club “description” field had no length limit and no filtering at all before being written into the lobby page’s HTML, so a malicious description would execute automatically for anyone who opened that club.

From there, the reported proof of concept used an iframe to reach into the live table on the same subdomain, read hole card data that JavaScript running in that context could already see, and exfiltrate it to an attacker-controlled server, all without the victim doing anything beyond opening a club page.

Two things are worth taking from this case specifically. First, it’s a real, independently verified instance of the general principle this article has been making: once code can run in the same browser context as the table, hidden information stops being hidden, regardless of the specific mechanism. Second, per the disclosure timeline, PokerNow has not responded to the recent exploits as of August 2026. It does not change the fact that this exact class of vulnerability, unsanitized input reaching a browser context that also holds hidden card state, is structurally likely to recur, precisely for the reasons laid out earlier in this piece.

Why This Keeps Happening Instead of Getting Fixed

PokerNow’s entire value proposition rests on being frictionless. No installation, no account creation in many cases, no download, just a link that opens a working poker table in seconds. That simplicity is precisely what makes the security side difficult. Every one of the anti cheat techniques available to a desktop client, binary obfuscation, kernel level anti tamper, detection of memory editing tools, simply does not exist inside a browser sandbox. The platform is fundamentally trusting JavaScript code running on a machine that the player themselves fully controls. That is an adversarial environment by definition, and no amount of front end cleverness changes that basic fact.

There is also a straightforward incentive problem. PokerNow largely serves free social games and private home games rather than licensed real money tables regulated by a gaming authority. Regulated operators face legal and financial consequences for exactly this class of vulnerability, and that pressure funds dedicated security teams, regular third party audits and formal bug bounty programs. A platform whose core product is free has a much harder time justifying that level of ongoing investment, even though the underlying engineering problem is exactly as serious.

What Correct Mitigation Actually Looks Like

The fix for essentially every category of leak described above comes down to one principle applied consistently and without exception. Never send data to a client that the client is not currently allowed to see. That sounds simple, and conceptually it is, but it requires discipline applied at every single point where state moves from server to browser, not just the obvious ones.

• Hole cards should only ever be transmitted to the specific connection that owns them, filtered on the server before anything is sent, never broadcast to every client with a flag telling the interface to hide it.
• The per seat card fields simply should not exist in the payload delivered to a connection that is not entitled to see them, rather than existing but being marked hidden, so there is no value present to extract in the first place.
• Cards should be actively pushed to other players only at the exact moment they become legitimately public, such as a showdown or a voluntary reveal, rather than being delivered earlier and simply withheld by the interface until that moment.
• Reconnect, rejoin, replay and spectate code paths need the exact same server side filtering logic applied independently, since these are consistently where over delivery mistakes slip through even in codebases that get the main game loop right.
• Security review needs to happen at the level of raw WebSocket payloads and network traffic, not just the rendered interface, since a table can look completely correct on screen while the underlying data stream is already leaking everything.
• Automated tests should specifically assert that hidden information never appears in a given connection’s payload, rather than only testing that the visible interface renders correctly, since the two are not the same guarantee.

None of this requires exotic technology. It requires treating every network message as a potential leak point and auditing accordingly, which is a discipline problem as much as a technical one.

The Bigger Picture

This pattern is not unique to PokerNow. It shows up across almost every real time browser application that handles some form of hidden information, from other browser card games to hidden role party games to fog of war strategy titles. The lesson security researchers keep rediscovering across all of these products is the same one. Hiding something on the client is not the same thing as keeping it secret. If a piece of data reaches the browser at all, in any form, a sufficiently curious user can generally get to it using tools that already ship with every browser on the market, no special software required.

For any platform operator building something similar, the practical takeaway is to treat interface level hiding as a cosmetic choice rather than a security boundary. Real secrecy has to be enforced at the point where data leaves the server, not at the point where it is drawn on screen. Until that principle is applied consistently across every code path, including the ones that only run during edge cases like reconnects and replays, this exact category of exploit will keep resurfacing under new names on new platforms.

Our Recommendation

PokerNow doesn’t process real money itself, but that’s not how most of its private tables actually work in practice. Its whole appeal is hosting home games, and home games are overwhelmingly real-money games, tracked through the built-in ledger and settled outside the app between friends. Functionally, a lot of PokerNow traffic is real-money poker, even though the platform never touches a deposit or withdrawal.

Given that, and given everything above, our recommendation is straightforward: don’t rely on PokerNow for any game where real money is actually on the line. The core issue isn’t any single bug, including the ones documented above. It’s that the platform’s entire security model rests on browser-side trust, and browsers are, by design, not a trustworthy place to hide information from the person operating them. A regulated real money operator absorbs that risk with compiled clients, dedicated security teams, and regulatory pressure to keep investing in it. PokerNow, built to be free and frictionless, structurally cannot match that, and the June 2024 case shows the category of bug that gap produces is real, not hypothetical. If the stakes are purely social, that tradeoff is probably fine. If real money is changing hands, it isn’t.

Built on GGPoker’s technology

WSOP.com’s client is built on GGPoker’s software stack under a partnership arrangement, which explains why the interface and several features, such as Smart HUD style statistics tools and similar lobby conventions, feel closely related to GGPoker’s international product despite operating under an entirely separate license and player pool. This is a common pattern in regulated markets: rather than building a new poker engine from scratch for each jurisdiction, established operators license their software to a US facing brand that operates under the specific state licenses required for real money play.

State by state licensing, and why that matters

Online poker in the US remains regulated at the state level, and WSOP.com only offers real money play in states that have specifically legalized and licensed it, currently including New Jersey, Nevada, Michigan, and Pennsylvania. Players in any other state can typically only access play money tables, since operating real money games there would violate that state’s own gambling laws.

This licensing structure is the actual source of the security and fairness guarantees regulated sites can offer that offshore sites generally cannot. A state gaming regulator requires independent RNG certification, mandated segregation of player funds from operating capital, regular financial audits, and a legal complaint process if a player has a dispute with the operator. None of this exists in the same enforceable form for a site operating outside any licensing jurisdiction, regardless of how that site markets its own security practices.

Shared liquidity across state lines

A structural challenge every state regulated site faces is player pool size, since a single state’s player base is a small fraction of what a global site can offer. WSOP.com addresses this through an interstate agreement, the Multi-State Internet Gaming Agreement, which allows player pools from participating states to be combined into shared tournaments and cash games, rather than each state running as a fully isolated island. This is a genuinely complex technical and legal undertaking, since it requires reconciling different state regulations while still keeping each state’s specific compliance requirements satisfied for players physically located there.

The WSOP brand advantage

Beyond the technical stack, WSOP.com leans heavily on its connection to the live World Series of Poker, running online bracelet events and satellites into live WSOP tournaments that carry real prestige within the poker community in a way few competitors can match. For a US based player who cannot access GGPoker’s larger international pool due to licensing restrictions, this is one of the more meaningful ways to pursue a genuine WSOP bracelet without traveling to a live event.

Verdict

WSOP.com is not competing on raw traffic against unregulated global sites, and it does not need to. Its value proposition is the thing offshore sites structurally cannot offer: real regulatory oversight, audited fund segregation, and a legitimate path to WSOP branded events, all within a legal framework a US player can actually rely on if something goes wrong. For players in a licensed state, it remains one of the more straightforward ways to play online poker for real money without stepping outside a regulated system.

PowerFest and MTT structure

PowerFest is partypoker’s flagship tournament series, running multiple times a year with a broad range of buy-ins and guarantees. The site has also built a reputation for tournament structures that skew toward players, with deep starting stacks and slower blind levels relative to some competitors, which recreational players and grinders alike tend to appreciate.

Recreational-first positioning

partypoker has been explicit about wanting to be the friendliest room for casual players rather than the biggest one, and features like fast-fold cash games, jackpot sit-and-gos, and a promotional calendar aimed at rewarding participation over pure volume all point in that direction. The player pool is smaller than the traffic leaders, but it skews more casual as a result.

Software

The client has been rebuilt more than once over the years and is generally clean and easy to navigate. It doesn’t carry the feature depth of GGPoker’s newer software, but for cash games and tournaments it covers the essentials without much of a learning curve.

Verdict

partypoker isn’t trying to out-traffic PokerStars or out-innovate GGPoker. It’s carved out a smaller but genuinely recreational-friendly niche, with structures that favor players and a tournament series worth scheduling around. For players who value game quality over sheer table count, it’s worth keeping an account active.

Recreational-focused player pool

888poker has leaned into a recreational identity for years, and the player pool reflects it. Because the site never chased the same volume of high-frequency grinders as PokerStars or GGPoker, the ratio of casual players to regulars tends to be friendlier, especially at low and mid stakes. This is the main reason experienced players keep a 888poker account active even if it isn’t their primary room.

XL series and tournaments

The XL series is 888poker’s flagship tournament stretch, running several times a year with a mix of guaranteed events across buy-in levels. It doesn’t match the scale of PokerStars’ WCOOP/SCOOP or GGPoker’s WSOP-branded series, but the fields are correspondingly softer, which suits players optimizing for return rather than prestige.

SNAP poker

SNAP is 888poker’s fast-fold format, functionally similar to Zoom on PokerStars. You’re moved to a new hand and a new table the instant you fold, which maximizes hands per hour for players who prioritize volume.

Software

The client is straightforward and reasonably modern, without the feature sprawl of some competitors. It’s an easy site to learn on, which fits with the site’s broader recreational positioning. It doesn’t offer the same tournament density or cash game depth as the biggest rooms, so multi-tabling grinders looking for constant action may find the selection thinner at odd hours.

Verdict

888poker won’t be your first choice if you’re chasing traffic or the deepest tournament series, but as a source of consistently softer games, particularly for cash game players at low and mid stakes, it remains one of the more underrated rooms in regulated markets.

Exiting grey markets and consolidating onto iPoker

According to reporting on Entain’s restructuring and related coverage, partypoker entered 2026 having already exited a number of European grey markets, jurisdictions where the site previously operated without a specific local license under regulatory frameworks that have since tightened. Its French and Spanish player networks were migrated onto the iPoker Network rather than continuing to run on partypoker’s own proprietary software stack. Entain also completed the migration of its Bwin and GiocoDigitale brands onto iPoker in Italy, which effectively marks the final shutdown of the older, standalone partypoker European network structure that had operated for years prior.

Why a company folds its own network into someone else’s

Running a proprietary online poker network is expensive: it requires dedicated software development, its own liquidity generation strategy, and continuous compliance work across every jurisdiction where it operates independently. iPoker, by contrast, is a shared network that multiple skins, meaning multiple branded front ends operated by different companies, all connect into for a combined player pool. Migrating a struggling regional operation onto a shared network like iPoker is a common way to reduce operating costs and effectively outsource liquidity generation, accepting a smaller share of a larger combined pool rather than continuing to fund an independent one that may no longer be large enough to sustain itself economically.

The US pivot toward BetMGM

While the European side of the business has been consolidating and shrinking, Entain’s actual growth focus for real money poker has shifted toward the US market through BetMGM Poker, operating across New Jersey, Pennsylvania, and Michigan under regulated state licenses. This mirrors a broader pattern across the industry, discussed elsewhere on this site regarding WSOP.com, where the regulated US state by state model, despite its smaller individual player pools, is increasingly where major operators are directing new investment, compared to the more fragmented and increasingly consolidating European market.

A brand for sale

Adding further context to the restructuring, Entain has reportedly retained a London based financial services firm to explore selling the partypoker brand outright, having concluded it is no longer a core strategic asset for the company. That process has been ongoing since 2024 without a confirmed completed sale as of mid-2026, with Entain continuing to operate and restructure the brand in the meantime rather than treating it as already wound down.

What this means if you still play there

None of this necessarily changes the day to day experience for a partypoker player in a market where the brand still operates directly, such as its PartyPoker Tour live events, which continued running stops across the UK and Spain in 2026. It does mean the underlying business is smaller, more consolidated, and more clearly positioned as a legacy brand than a growth priority, which is worth keeping in mind for anything that depends on long term platform investment, such as software updates or an expanding tournament schedule.

The Beast and ongoing promotions

ACR’s signature promotion is The Beast, a daily leaderboard race that pays out based on rake and tournament fees contributed rather than results alone, which gives grinders a steady secondary income stream on top of whatever they win at the tables. The site layers a rotating set of additional leaderboards and freerolls on top of that, which keeps the promotional calendar busy even between the network’s major series.

Blaze and fast formats

Blaze, ACR’s jackpot fast-fold format, is one of the more polished versions of this style of game, with an anonymous, rapid-fire table structure that suits players who want a lot of hands per hour without the commitment of a deep-stacked tournament. It’s a good showcase of the network putting real development effort into something beyond the standard cash game and MTT menu.

Anonymous tables

ACR runs largely anonymous tables, meaning player usernames aren’t tied to a persistent, searchable history the way they are on sites like PokerStars. This is a deliberate design choice aimed at protecting recreational players from being tracked and targeted by tracking software and database-driven regulars, and it’s a meaningfully different table dynamic if you’re used to HUD-heavy competitors.

Software

The client is functional rather than flashy. It gets the job done across cash games, tournaments and Blaze, and the mobile experience has improved considerably, but it doesn’t have the visual polish of GGPoker’s newer interface or the sheer feature depth of PokerStars.

Verdict

Americas Cardroom isn’t trying to be the biggest room in the world. It’s trying to be a dependable, US-accessible option with anonymous tables and a strong grinding-friendly promotional structure. For players without a regulated in-state alternative, it’s one of the more established names still standing.

Tournaments first

Tournaments are where GGPoker puts most of its energy, and it shows. The site runs an enormous slate of guaranteed events, including online bracelet series tied to the WSOP brand, and the overall tournament ecosystem is arguably the deepest of any site outside the US market. Satellites into both online and live WSOP events are a recurring draw for grinders who want a realistic, low-cost path to a bracelet event.

Format innovation

GGPoker has leaned harder into new formats than most competitors. All-in Showdown lets players opt into a fast, jackpot-style shove-or-fold mode. Staking and backing tools are built directly into the client rather than handled through third-party forums, which is a meaningful convenience for stakers and horses alike. Smart HUD, the built-in statistics overlay, is also a departure from the traditional “no third-party software” stance most rooms take, and it’s a genuine differentiator for players who like data at the table without installing anything separate.

Software and interface

The client is modern and clearly built more recently than legacy competitors’ software, with a cleaner visual style and a mobile app that holds up well against the desktop version. The tradeoff is that the sheer number of built-in features, staking, missions, smart HUD, multiple lobby views, can feel cluttered to a player who just wants to sit down and play a hand.

Verdict

GGPoker is the room to be in if tournaments, and specifically WSOP-branded tournaments, are your priority. The pace of feature development has been genuinely impressive, even if it occasionally comes at the cost of simplicity. For cash game specialists, it’s a solid option, but tournaments remain where GGPoker has staked its identity.

A field that blew past its own guarantee

According to PokerNews’ coverage of the event, the tournament drew 7,309 entrants across multiple starting flights, generating a prize pool of $10,415,325, comfortably clearing its own $10 million guarantee. The minimum cash for reaching the final table alone was $174,213, giving a sense of how top heavy the payout structure was even before the final negotiations began.

The three way deal

Once the field was down to its final three players, “filthiest” from Ukraine, Max Rotko from Finland, and “Lord Given” from Serbia negotiated a settlement rather than playing the remainder out for winner take most stakes. The agreed numbers were close enough to reflect a genuinely even three way deal rather than one player conceding a large edge: “filthiest” locked up $1,109,637, Rotko took $1,094,691, and Lord Given secured $1,091,345. Play then continued for the title itself, with Lord Given going on to win the resulting heads up match against Rotko.

The staking angle that made this bigger than three winners

One detail from the final table extended the payday beyond the three players actually seated. Elias Suhonen had purchased 10 percent of Max Rotko’s action through GGPoker’s built in staking software, a feature that lets players buy and sell pieces of each other’s tournament entries directly through the platform rather than relying on outside forums or private arrangements. That stake alone earned Suhonen $109,469 without him playing a single hand of the tournament himself, a reminder that deep runs in large field events like this one routinely create paydays for backers sitting well outside the money the public leaderboard actually shows.

Why deals like this happen at this stage

A three way deal of this kind is a rational response to the shape of the remaining pay jumps rather than a sign that any of the three players lacked confidence in their own play. Once the gap between first and third narrows relative to the variance of playing three handed poker for the difference, locking in a guaranteed seven figure result for all three players and letting only the title itself remain contested is a common and, in a spot like this, mathematically defensible way to close out a tournament of this size.

Traffic and game selection

Traffic is still the single biggest reason to play here. Cash games run around the clock at every stake from micro to nosebleed, and the tournament schedule is deep enough that there is almost always something starting in the next few minutes. The Sunday schedule, anchored by the Sunday Million, remains a fixture of the online grinding calendar, and the twice-yearly WCOOP and SCOOP series still draw some of the largest prize pools in online poker.

Beyond No-Limit Hold’em, PokerStars puts real effort into game variety: Pot-Limit Omaha, mixed games, Spin & Go style jackpot sit-and-gos, and rotating novelty formats all have a real, liquid player base rather than existing as a token menu item.

Software and mobile

The desktop client is powerful but shows its age in places. The settings menus have accumulated years of features, and new players can find the sheer number of options overwhelming. The mobile app is the more polished experience for casual play, with a cleaner interface that trades some of the desktop client’s depth for simplicity.

Recreational-friendliness

This is the perennial complaint. PokerStars has historically prioritized regular, high-volume players over recreational ones, and the field at mid and high stakes reflects that: a higher proportion of grinders and multi-tabling regulars than you’ll find on more casual-leaning sites. Lower stakes and the Spin & Go format remain the friendliest entry points for newer players.

Verdict

PokerStars earns its reputation through sheer scale rather than being the softest game in town. If your priority is finding a game at literally any hour, at any stake, in almost any format, nothing else matches it. If you’re specifically hunting for the softest possible fields, you’ll want to look elsewhere on this list.

Four tiers, one schedule

Rather than running a single buy-in structure, the festival is split into four distinct tiers, generally labeled Low, Medium, High, and Super, spanning the schedule side by side. This structure lets GGPoker run the same event concept, the same daily Main Event slot for instance, at multiple buy-in levels simultaneously, so a recreational player on a modest bankroll and a high stakes regular chasing a seven figure score are both playing what is nominally the same tournament brand at completely different price points.

Why a series gets built this large

A guarantee this size is not simply a marketing number picked in isolation. Guarantees are underwritten against expected field sizes based on historical data from comparable prior series, and a shortfall between the guarantee and the actual prize pool generated by entries is covered by the operator itself, meaning GGPoker is taking on real financial risk if turnout falls short across 1,600-plus events. Running that many events across four tiers over five weeks, rather than concentrating everything into a shorter, higher intensity window, spreads that risk across a longer period and gives the operator more scheduling flexibility to react if certain tiers are underperforming relative to projections.

What this means competitively

Series of this scale function as a direct competitive answer to PokerStars’ long running WCOOP and SCOOP franchises, which have historically been the largest recurring series in online poker. A guarantee north of $300 million positions GGPoker’s festival as comparable in scale to, and in this specific instance larger than, those established series, reinforcing GGPoker’s broader strategy of using aggressive tournament guarantees as its primary lever for player pool growth, rather than competing purely on cash game traffic where PokerStars has historically held a structural advantage built over two decades.

The takeaway for players

For a player deciding where to spend a bankroll during this window, the practical value of a series like this is depth rather than any single headline number. With four tiers running in parallel across more than 1,600 events, there is a genuinely playable version of this festival at almost any bankroll size, which is a meaningfully different proposition than a series that guarantees a large total concentrated in a handful of marquee events most players will never realistically buy into.

A stacked final table

The final table drew players from Argentina, Malta, Estonia, Finland and beyond, a reflection of the kind of genuinely international field GGPoker’s high roller schedule regularly attracts. Teun Mulder came into the final table as chip leader with 6,053,124 chips, roughly 86 big blinds, a substantial cushion heading into nine handed play, and Alejandro Lococo emerged as his final opponent heads up.

How it ended

The deciding hand did not take long to develop once heads up play began. Lococo limped in with ace ten of clubs and called instantly when Mulder moved all in holding a comparatively weak five four of spades, a spot where Mulder was behind before any community cards had even been dealt. The flop reversed everything: Mulder flopped a full house, leaving Lococo needing running cards just to survive, and the turn ended it, with Lococo drawing dead before the river was even dealt.

The payouts

Mulder’s win was worth $476,561, along with a $10,000 GGMillion$ Live Paradise ticket layered on top of the cash prize, a common structure GGPoker uses to connect its online high roller schedule directly to its live festival presence. Lococo’s runner up finish still paid $367,478, a reminder that heads up variance in a hand like this one can separate two very large paydays by a fairly thin margin, decided entirely by a single flop.

Why hands like this matter beyond the result

A cooler of this size, a covering stack getting there with the weaker hand before the flop even comes down, is not a strategic lesson so much as a demonstration of exactly how thin the margin is at the top of a high roller final table. Mulder’s overall chip lead heading into heads up play mattered less in this specific hand than the run of the board once the money was already committed, which is a useful reminder for anyone tracking a final table live that a dominant stack lead can evaporate in a single hand regardless of how the rest of the table played out.

Two bounty formats running side by side

The series leans on two related but distinct formats. Progressive bounty events pay a player cash immediately for every opponent they eliminate, and that player’s own bounty value grows with every knockout they collect, meaning eliminating a player who has already knocked out several others pays considerably more than eliminating one who has not. Mystery bounty events add a layer of unpredictability on top of that structure: bounty values are hidden until the moment of elimination, so knocking out a short stacked opponent can occasionally pay far more than the stack size alone would suggest, and knocking out a monster stack can turn out to be a min cash bounty.

Volume over concentration

Rather than concentrating the guarantee into a handful of marquee events, the series ran a genuinely high volume schedule: 36 events per day from Monday through Saturday, stepping up to 40 events on Sundays. Buy-ins ranged from $10 up to $1,500, with the large majority of events priced at $150 or below, which keeps the series accessible to recreational players rather than positioning it primarily as a high stakes showcase.

The marquee events

Three events anchored the schedule specifically. The $25 Mystery Bounty Mini Main ran its Day 2 on April 13. The $5.40 Bounty Hunters Warm Up reached its final stage on April 20. The series’ crown jewel, the $108 Mystery Bounty Main Event, played its Day 2 on April 27, closing out the series the following day.

A separate schedule for Ontario

Players in Ontario, who play under a separate regulated player pool due to Canadian provincial gaming rules, had their own parallel version of the series, guaranteeing $2,000,000 across the same April 5 to 27 window, headlined by a $250,000 guaranteed Mystery Bounty Main Event scaled appropriately for that smaller, jurisdiction locked player base.

Why this format keeps growing

Bounty formats have become one of the more consistently popular tournament structures across the industry precisely because they change the incentive structure of the entire tournament. A short stacked player is never simply grinding for a min cash, since every remaining opponent they eliminate pays out immediately regardless of their own final finishing position, which keeps more of the field engaged for longer and produces the kind of aggressive, action heavy play that shorter, lower buy-in recreational fields tend to reward.

What was actually taken

According to Phenom’s own account of the incident, an attacker compromised a team member’s personal machine and used that access to obtain a private key, which was then used to transfer approximately $94,267 in USDC out of the platform’s token liquidity pool, the reserve of funds used to facilitate trading of Phenom’s native token. This is not a hole card leak or a game integrity issue. It is closer to a conventional crypto asset theft that happened to target an operator whose product is poker.

Phenom’s CEO, Matt Valeo, stated after the investigation that “all systems are safe and ready for use again.”

Why player balances were never actually exposed

The critical detail in this incident is architectural. Phenom’s player funds are held in individual user wallets that the company itself does not control, rather than pooled in a central custodial account. Because of that separation, compromising a company controlled private key gave the attacker access to the liquidity pool, but gave them no path to actual player balances. This is the same principle that shows up repeatedly across this site in a different form: a system designed so that a single compromised credential cannot reach data or funds it was never supposed to touch in the first place limits the blast radius of a breach almost automatically, regardless of the specific asset being protected.

What Phenom actually changed afterward

The response went beyond simply restoring the stolen liquidity. Phenom announced it would transition to an in-game currency called CHIP specifically to remove stablecoin holdings from its smart contracts going forward, reducing the amount of directly convertible value sitting in any single compromised component. The site brought cash games back online first, on April 4, while tournaments remained paused briefly longer, and any tournaments that were running at the time of the incident were paid out using standard ICM calculations rather than being voided.

The broader lesson for crypto facing poker sites

Traditional poker platforms worry about hole card leaks and RNG integrity. Crypto native platforms inherit an entirely separate category of risk on top of those: private key management, smart contract design, and the security of the individual devices belonging to the team that operates the platform, since a single compromised laptop turned out to be sufficient here regardless of how well the poker software itself was built. For players evaluating a crypto poker site, the Phenom incident is a reasonable illustration of the specific question worth asking: not just whether the shuffle is fair, but whether your funds are architecturally separated from the operator’s own infrastructure in a way that survives a breach on their end.