Hacker’s Leak Exposes Secret Owners of Curaçao’s Gambling Empire

Key points

• Lilith Wittmann gained access to the CGA system in December 2025 using a false identity and a security vulnerability, downloading tens of thousands of documents.
• The leaked files reveal that the CGA granted licenses despite applicants failing to provide essential information or verify the actual control of the companies.
• Specific owners were identified, including Nick van Gorsel for Blaze, Mladen Vuković for Stake, and Igor Gnedash for 1xBet, contradicting public records or known founders.
• The investigation highlights that 94% of gambling companies in Curaçao have at least one Dutch director, with many owners based in Ukraine, the UK, and Cyprus.
• Wittmann plans to release the full list of ultimate beneficial owners, which could expose sensitive personal data of crypto casino operators.
• The CGA stated the sector is in a transition period following new 2024 legislation, allowing time for compliance rather than immediate license revocation.

Background

Curaçao has long been a hub for online gambling due to its lax regulatory environment, attracting thousands of operators who often use anonymous letterbox companies to obscure ownership. This opacity has made it difficult for regulators and journalists to identify responsible parties, fueling concerns about money laundering and illegal operations. The recent leak follows a similar breach at the Malta Gaming Authority earlier in 2026, highlighting ongoing security vulnerabilities in gaming regulators. The new 2024 legislation in Curaçao aimed to improve transparency and anti-money laundering compliance, but the leak suggests that enforcement remained inconsistent during the transition period.

How outlets are covering it

Follow the Money and its international partners (NRK, NDR, Jetzt, SVT) emphasize the systemic failure of the CGA to verify ownership and the role of anonymous shell companies in facilitating illegal gambling. They highlight specific cases where declared owners did not match public knowledge, such as Stake and 1xBet. UA.NEWS focuses on the individual hackers’ actions and the specific financial declarations of the exposed owners, noting the discrepancies between declared assets and public records. NEXT.io highlights Wittmann’s intent to release the full list of ultimate beneficial owners and compares the breach to the earlier Malta Gaming Authority incident, noting the legal actions taken against her. Cryptonews.net focuses on the potential impact on crypto casinos, suggesting that sensitive data like KYC information might be leaked or used for extortion, and notes that some licenses, such as Rollbit’s, have been revoked. The CGA’s perspective, as reported by NEXT.io, is that the sector is in a transition period under new laws, and they are assessing the scope of the breach.

Why it matters

The leak exposes the extent of secrecy in Curaçao’s gambling industry, revealing that major online casinos were operated by individuals who were not publicly known or were not the declared owners. This undermines the integrity of the regulatory framework and raises serious concerns about money laundering, illegal operations, and the protection of vulnerable gamblers. The potential release of the full list of ultimate beneficial owners could have significant implications for the industry, potentially exposing operators to legal action, regulatory scrutiny, and public scrutiny. It also highlights the vulnerabilities in the security of gaming regulators, which could have broader implications for the integrity of the gambling industry and the protection of personal data.

What to watch

Lilith Wittmann has indicated plans to release the full list of ultimate beneficial owners, which could expose the identities of operators behind many online gambling sites, including crypto casinos. The CGA is expected to issue a formal statement regarding the breach and the scope of the data accessed. Regulators and law enforcement agencies may investigate the leaked information to identify illegal operations and potential money laundering. The gambling industry may face increased scrutiny and regulatory changes in response to the leak. Wittmann may face legal action, similar to the preliminary injunction served by the Malta Gaming Authority. The leak could lead to a broader debate about the transparency and security of gaming regulators and the need for stricter oversight in the gambling industry.