The superuser: when the house could see your cards

The ten-high call

In September 2007 an account named POTRIPPER won a $1,000-buy-in tournament on Absolute Poker in a way that read less like a hot streak than a solved game. He folded exactly when he was behind. He bet exactly when he was ahead. In the final hand he called an all-in bluff holding ten-high — a call no information available to a player could justify, and the only call that wins.

Poker players are connoisseurs of bad beats and worse suspicions, and forums fill daily with accusations that come to nothing. This one did not, because the winner’s play was not merely lucky. Luck shows up as good cards; POTRIPPER’s edge showed up as good decisions, hand after hand, at a rate no distribution of cards can produce.

The evidence arrives by accident

What turned suspicion into proof was a clerical error. A finalist named Marco Johnson requested his hand history from the tournament. Absolute’s support staff sent him the wrong file: a master log covering the event’s early play — with every player’s hole cards, plus IP addresses and the observer accounts watching each table.

Johnson passed it to the forum crowd, and the analysis wrote itself. With all cards visible, POTRIPPER’s decisions stopped looking superhuman and started looking mechanical: each fold, call and raise was the straightforwardly correct play for someone reading both hands. Gambling mathematician Michael Shackleford, brought in to review the log, put it plainly: hand after hand, the play was consistent with knowledge of every opponent’s cards.

Hand after hand POTRIPPER’s play is consistent with that of a player who had knowledge of every player’s hole cards.Michael Shackleford, reviewing the leaked Absolute Poker hand history

The same file showed how. An observer account was logged in from inside the company’s network, watching every table POTRIPPER played — an account with a view no player was supposed to have. The industry borrowed a name from computing and called it a superuser.

The sequel was bigger

Absolute’s regulator, the Kahnawake Gaming Commission, investigated and in January 2008 found that seven linked accounts had cheated over roughly 40 days. Absolute refunded $1.6 million and paid a $500,000 fine. Embarrassing, contained — and, it turned out, the small case.

Months later, players at UltimateBet — Absolute’s sister site on what became the Cereus network — flagged accounts with the same signature: win rates far beyond statistical norms, one called NioNio first among them. The site’s announcement admitted cheating from March 2006 to December 2007. The investigation kept pushing the start date back, eventually to June 2003. This was not a forty-day breach. It was a business line running for years.

Figures from the Kahnawake Gaming Commission’s findings and contemporary reporting. Hamilton was found to be the main person responsible and the largest beneficiary; in a later recorded conversation he put his own take at $16–18 million.

The Kahnawake commission found that the computer devices and IP addresses behind the cheating accounts led overwhelmingly to one man: Russ Hamilton, a consultant to the site and a world champion of the game. The tool was reportedly a leftover from development — code that let its operator see hole cards, kept alive in software the players had every reason to assume was finished.

What a fairness proof does not cover

Put this case next to Ronald Harris, the regulator’s engineer who predicted a keno draw. Harris attacked randomness: he knew what numbers were coming. The superusers attacked information: the deal was perfectly random and they cheated anyway, because in poker the deal is only half the secret. The other half is what the cards are once dealt — and no shuffle, however honest, protects that.

• A randomness proof certifies the draw, not the room. Commit-reveal schemes — the kind you can verify here — prove the house did not steer the outcome. They say nothing about who else could see the state of the game while you played it.
• Player-versus-player games carry a risk house games do not. Cheating in a house game means the operator robbing you openly, in the odds, where it can be measured. Cheating in a poker game means an information leak, invisible by construction: the loser just thinks they ran bad.
• Statistics caught what secrecy hid. No audit, regulator or seal flagged either site. Players with spreadsheets did, from win rates alone — the same instrument that vindicated the MIT team’s honest edge condemned a dishonest one.

That last point deserves its emphasis. The proof that convicted the superusers was not cryptographic. It was distributional — results too good, sustained too long, against too strong a field. The community ran the numbers because the operator would not show its own. Every fairness system since is, in one way or another, an attempt to make that community audit unnecessary by making the operator’s honesty checkable up front.

Why a house-game casino tells this story

Betkyo runs no player-versus-player poker, and that is not an accident of the catalog. Every original here is a house game: your only opponent is a paytable published before you bet, and the outcome is a committed draw you can recompute afterward. There is no second player whose screen could quietly show your hand, because there is no hand to hide — the entire game state is yours.

The honest limit still applies, and it is the same one the superuser case teaches. A verified draw proves the round was not steered. It does not prove the price is kind — only the published paytable answers that — and in any game where players face each other, it cannot prove your information stayed private. The 2007 scandals are why that distinction is worth stating precisely: the sites that hosted them had honest decks the whole time.