A leak dubbed Casino Secrets has made public tens of thousands of confidential files held by the Curaçao Gaming Authority, disclosing ownership, licensing and source-of-wealth information on offshore casino operators. The records include material concerning Stake.com, BC.Game, Santeda International and Oddsbet, and have reopened questions about who controls some companies licensed in the Caribbean jurisdiction.
The authority confirmed that its online portal had been subject to unauthorised access and described the incident as an ongoing, complex forensic matter. As we reported on Sept. 17, the regulator had contained the intrusion but had not then established whether stakeholder data had been accessed.
Berlin-based hacker Lilith Wittmann said she obtained the documents from a Curaçao Gaming Authority database. Casino.org, which reported the breach on Sept. 22, said Wittmann and collaborators had claimed access to internal systems for nine months, including licence applications, regulatory assessments, passports, tax returns and financial information.
Wittmann said the access showed “who owns illegal online casinos, who finances them, and what the authority knew about their operations.” Follow the Money’s analysis of the material identified about 800 owners across nearly 650 licensed gambling companies that operate thousands of websites.
The documents concerning Stake’s Curaçao-registered company, Medium Rare NV, identify Serbian national Mladen Vučković as owner and show that he declared assets of more than $1 billion to the regulator in 2024. They also show regulators questioning whether he was the real owner after finding millions of dollars paid to companies connected to Stake founders Ed Craven and Bijan Tehrani, neither of whom appeared on the licence application.
The regulator nevertheless issued Stake a licence. Separate leaked records raised similar questions around 1xBet: Caecus NV listed Ihor Hniedash as owner and chief executive, while assessors sought information about his relationship with Russian figures publicly associated with 1xBet. Caecus received a licence in 2024 without the requested answers, according to Casino.org.
Santeda’s filings named Onise Chimakhidze as owner, while listing Upgaming email addresses and referring to Upgaming in file names. A 2025 document described Torniki Kapanadze as Santeda’s finance chief, and a LinkedIn profile identified a similarly named Tornike Kapanadze as working for Upgaming. Santeda also made six loans worth €15.6 million to Buda Capital, a Luxembourg company owned by Georgians who hold stakes in or direct Upgaming.
Upgaming’s lawyers said there might once have been a business relationship with Santeda, but that it had ended. They said the company could not speculate on why a third party had listed its contact details without seeing the documents.
Santeda is the holding company for Rolletto, CosmoBet and ZizoBet. The Guardian and Investigate Europe found that casinos owned by Santeda appeared to target vulnerable British gamblers trying to stop gambling, despite Santeda lacking a UK Gambling Commission licence.
The leak also indicated that Oddsbet was owned until 2025 by Robert Bostock of Goole, East Riding of Yorkshire. Filings said his funds came from long-term cryptocurrency investments and a £100,000 loan from another UK-based person, and suggested he sold Oddsbet for $240,000 in 2025.
The disclosures come from a jurisdiction hosting more than 8,000 online casinos, roughly one for every 20 residents. Curaçao’s licensing system has attracted operators unable or unwilling to obtain licences in more stringent markets, while BC.Game has previously been accused of accepting UK customers after surrendering its right to serve them and Stake withdrew from the UK in 2025.
The UK Gambling Commission said illegal gambling activity was a serious threat and that it worked with partners to identify and disrupt operators outside the regulatory framework. The Curaçao Gaming Authority said it would provide further updates on its forensic investigation.
