WPN Introduces Screen Shield Following High-Stakes Cheating Scandal

Winning Poker Network (WPN) CEO Phil Nagy has addressed the recently uncovered cheating case involving high-stakes online poker players. In a nearly seven-minute video, Nagy discussed the series of cyberattacks in which several high-stakes players may have had their computers compromised, potentially allowing attackers to see their hole cards in real time.

Based on the information disclosed so far, there is no indication that the poker clients themselves were hacked. Instead, attackers allegedly used manipulated versions of third-party poker tools to install remote-access software on players' computers.

Players on WPN — including ACR Poker and PokerKing — as well as GGPoker and CoinPoker may have been affected.

Nagy announced that Winning Poker Network is responding with a new security feature called Screen Shield.

When Screen Shield is enabled, WPN poker tables are hidden from screen-recording, screen-sharing and remote-access applications. In theory, this also prevents an attacker from using such software to see a player's hole cards in real time.

On September 29, WPN contacted players whose computers were found to have software capable of remote access, screen sharing or screen control installed, and activated Screen Shield for those players.

According to Nagy, a future update will allow players to enable the feature themselves. WPN also plans to regularly check for these types of applications and offer Screen Shield when necessary.

There is a trade-off, however. Screen-sharing and recording software has many legitimate uses, and players using Screen Shield will not be able to take screenshots or stream their tables on platforms such as Twitch and Kick.

Nagy also indicated that WPN would be willing to make the technology available to other online poker operators.

ACR Poker previously announced that it had provided the affected players' hand histories to GTO Wizard for analysis. WPN is also conducting its own investigation, and compensation for affected players could follow depending on its findings.

One of the central figures in the case is a player named Paul Gregg. Information posted on the Two Plus Two forums has linked several accounts across different poker sites to Gregg and the alleged cheating operation:

• GGPoker: Paul Gregg
• CoinPoker: Europe
• WPN: JackKlompus, OxOO and Ez[Pz]

It is important to note that some of these connections are based on claims made by players and posts on poker forums rather than officially confirmed links.

Patrick Leonard has said that CoinPoker previously banned the Europe account, which was registered in Paul Gregg's name. According to Leonard, the site confiscated more than $100,000 and reimbursed affected players.

Investigations have identified two third-party poker applications through which attackers may have gained access to players' computers: Jurojin Poker and IntuitiveTables.

Jurojin said the infection involving its software was eliminated in January 2026. The company also released a verification tool allowing users to check whether their computers may have been affected. IntuitiveTables has also informed its users about the incident.

Tracking data published by players shows extraordinary results for some of the accounts involved. The WPN account JackKlompus reportedly won $414,200 over 76,700 hands, while OxOO generated another $423,500 in profit across 37,400 hands. Combined, the two accounts recorded nearly $838,000 in tracked winnings.

Manuel Saavedra, known online as J0hn Mcclean, said he had used the compromised software himself and played against an opponent who may have been able to access his hole cards. He published several pieces of evidence, including an image showing MeshAgent software on his computer.

Spanish high-stakes player Ignacio Morón told Poker Red that his own losses may have been between $150,000 and $200,000. According to estimates he had seen, accounts allegedly linked to Gregg may have won around $1 million on ACR Poker and another $1.5 million on GGPoker.

These figures remain estimates and have not been confirmed by the operators.

Morón also said CoinPoker reimbursed him $60,000 after banning the Europe account.

One of the biggest questions raised by the case is whether the suspicious results could have been identified much sooner.

High-stakes player Aleksey Borovkov said players began investigating more closely because of the extraordinary results generated by the accounts in question. They noticed that a significant portion of the winnings came from the same relatively small group of opponents and that the suspicious accounts appeared unusually eager to play against those particular players.

Patrick Leonard has claimed that around 100 regulars had previously raised concerns about suspicious accounts with multiple poker sites.

Run It Once coach Frankie Carson also highlighted the exceptional results generated by the WPN accounts, arguing that online poker operators' security systems should be capable of detecting statistical patterns of this kind.

The case has once again raised a long-standing question in online poker: should operators share information about players banned for cheating?

Morón believes the industry should operate more like Las Vegas casinos. If someone is caught cheating at one venue, other operators should be made aware of it.

Leonard has pointed out that such a system would be much more difficult to implement in online poker. Operators invest different amounts in security, compete directly with one another, and any shared system would create significant legal, privacy and trust-related challenges.

The latest case nevertheless demonstrates that online poker security can no longer be limited to protecting the poker client itself. If attackers can obtain sensitive information through third-party applications running on a player's computer, operators also need ways to respond to threats originating outside their own software.

Screen Shield is WPN's first concrete response to that problem.

The next major question will be what the ongoing investigation ultimately finds — and how much compensation, if any, affected players will receive.