CoinPoker banned an account registered to Paul Gregg about two years before the scandal broke and redistributed more than $100,000 from it, according to CoinPoker pro Patrick Leonard, and coach Patrick Howard says GGPoker contacted him on 2 October about a September report. Nobody has been charged.

The same week brought the first vendor account of how the Mesh Agent reached high-stakes players’ PCs. Table software maker Jurojin confirmed on 1 October that an attacker swapped its update packages for a chosen group of users between June 2025 and June 2026, naming IntuitiveTables as a second target.

Both tools behind the attack are now named by their own vendors, which closes the open line in our report on the Mesh Agent poker malware. The account the community links to the operator now has a documented history at three rooms.

No poker site has published a finding that ties any account to the agent, and no response from Gregg has been published.

The WPN and GGPoker account names come from Alexey “Avr0ra” Borovkov’s Telegram post of 29 September. The CoinPoker name comes from Leonard.

The Paul Gregg Poker Accounts: Five Names Across Three Rooms

The report by the researcher known as WolfSec0x0, published the same day as Borovkov’s post, names nobody and links no account to the agent. Every account name in this story is Borovkov’s.

The only public results data covers two of the WPN accounts, from tracking figures coach Frankie Carson posted on 30 September. They are tracked winnings, not anything WPN has confirmed.

Higher totals circulate in community posts, up to about $1 million across all rooms, with no published method behind them. The tracked figures are the only ones we carry.

WPN has said nothing on these three accounts. For how the network has handled past cases, we looked at ACR’s record on bots and cheats when the room marked 25 years in September.

CoinPoker Banned “Europe” Two Years Before the Scandal, Says Leonard

Leonard, the CoinPoker pro with 16 SCOOP titles, said the room’s security team flagged an account playing as Europe, closed it and confiscated more than $100,000. The money was redistributed to the players it had been won from, and the account was registered as Paul Gregg.

According to Leonard, Gregg disputed the decision and took a complaint to the licensing regulator, which did not proceed. Bobby James, a high-stakes regular, backed the timeline on X.

CoinPoker itself has not published an account of the case. If Leonard’s version holds, the room acted roughly two years before GGPoker received a formal report, and that gap is what the rest of the story turns on.

GGPoker Had a Report in September

Howard, a high-stakes cash coach who runs Mobius Poker, filed a report with GGPoker in September about the GGPoker account after unusual losses. He asked for an investigation rather than alleging cheating, and on 2 October he wrote on X that GGPoker had contacted him.

Howard also said a group of around 100 players had raised the account with poker sites years earlier, and that it kept playing. He has called the case one that “will change online poker forever”.

Gleb “psyhoagromor” Kovtunov said he had been raising the account privately since April. About a month before the story broke he passed his suspicions to a player group that tracks real-time assistance and other cheating, and the account stopped appearing roughly two days later.

Kovtunov later said he found Mesh Agent on his own PC. GGPoker has not issued a statement, so the comparison is its 2023 case: how GGPoker handled its 2023 superuser ended with a ban and $29,795 refunded after the community flagged it.

Why the timeline matters: rooms investigate privately and rarely comment while they do, so a gap between a report and a statement is not evidence of inaction. Only the rooms can say what happened to the warnings.

Jurojin Confirms Its Updates Were Swapped

Jurojin describes the attack as “a highly targeted operation, not a mass attack”, aimed at specific opponents at high stakes.

That answers the question our first report left open, which was the identity of the second tool. Which of the two is the report’s Tool A and which is Tool B is still not public.

What Has Not Happened, and What Would Change It

The list of things still missing is as telling as the list of confirmations. Each one has a single event that would close it.

The one comparable case that did reach a court took years. Peter Jepsen, the Danish pro jailed for poker spyware, was reported to police in 2014 and sentenced in 2019, with the appeal court confirming three years in 2020.

What Comes Next

The next moves belong to the rooms. CoinPoker can confirm or correct Leonard’s account, GGPoker can say where Howard’s report stands, and WPN can address the three named accounts.

The checks for Mesh Agent on your own PC are in our 30 September report, linked above. Whatever lands next will be covered in the follow-ups in our poker news section.

FAQs