Leaked documents expose hidden owners of Curaçao's multibillion-euro gambling empire

A Berlin-based hacker named Lilith Wittmann walked into the Curaçao Gaming Authority's licensing portal in December using a false identity and a Gmail address, and no one stopped her. Within days, she had access to the entire system. She uploaded software that gave her control of the portal, and she downloaded tens of thousands of confidential documents—the names of owners, licence applications, assessments, passports, tax returns, financial records. What she found was a window into a multibillion-euro industry that had operated in near-total darkness: the hidden owners of nearly 650 licensed gambling companies that collectively run thousands of betting sites worldwide, many of them blacklisted and fined for operating illegally across Europe, Australia, and the United States.

Curaçao, a self-governing Dutch territory with just over 150,000 people, has been a haven for gambling operators since the 1990s. Companies unable or unwilling to obtain licences in the countries where they actually operate can get one here, and the licence provides what amounts to a veneer of legitimacy—payment processors and software providers treat it as sufficient reason to work with an operator, even if the operator has no real permission to accept bets anywhere. For decades, the government granted master licences to a handful of private companies, which then sold sublicences with virtually no state supervision. The appeal was obvious: a Curaçao licence allowed a gambling platform to claim it was regulated, to access a friendly ecosystem of trust offices and payment companies, and to keep its true owners hidden behind anonymous letterbox firms. The system worked because no one could see inside it. Until now.

The documents reveal three individuals whose names would never appear in a corporate search but who control some of the industry's largest operations. Nick van Gorsel, a 30-year-old from North Brabant in the Netherlands, is one of two owners of Prolific Trade NV, the letterbox company behind Blaze.com, a Brazilian gambling site that faced legal proceedings after users complained their winnings were not paid out. Van Gorsel declared assets of €800 million to the regulator in 2024. His co-owner, American entrepreneur Nicholas Beugg, also 30, declared €500 million. Neither responded to questions. Joanna Tinaco Arenas, a 42-year-old tech manager in Manila, is listed as the ultimate beneficial owner of Novatech Solutions NV, the letterbox company behind Qbet.com. In March, the Dutch Gambling Authority fined Novatech nearly €25 million for operating illegally in the Netherlands. Until last year, Qbet was one of the biggest illegal gambling sites in the country and generated tens of millions in profits. The regulator said Qbet had been operating without permission; Novatech appealed the fine and did not respond to questions.

The documents also expose the owners of two of the industry's giants. Stake, the crypto casino with rapper Drake as its figurehead, is publicly associated with young tech billionaires Ed Craven and Bijan Tehrani, hailed by media as crypto kings. But on paper, Stake is owned by Mladen Vuckovic, a Serbian national registered as the owner of Medium Rare NV, the Curaçao letterbox company behind the site. Vuckovic declared assets of more than $1 billion in his 2024 disclosure. Regulators questioned whether he was really the sole owner—the documents show tens and sometimes hundreds of millions of dollars in loans and payments from Medium Rare to companies and individuals linked to Craven and Tehrani. Yet neither man was mentioned in Stake's licence application. Similarly, 1xBet, the Russian-founded gambling giant that sponsors top-flight football leagues including Italy's Serie A and Spain's La Liga, is publicly owned by three Russians: Roman Semiokhin, Dmitry Kazorin, and Sergey Karshkov, who died in 2023. But the documents show that Ukrainian national Ihor Hniedash is listed as both CEO and owner of Caecus NV, the Curaçao letterbox firm behind 1xBet. There is no other link between Hniedash and either the company or the gambling site. According to his disclosure, the 39-year-old earns just under €10 million a year from the company.

What emerges from the documents is a pattern of regulatory failure. Dozens of licence applications reviewed by Follow the Money show that assessors at the Curaçao Gaming Authority repeatedly identified serious problems—unclear sources of wealth, applicants with too little money to credibly own gambling companies, warnings from foreign regulators about illegal targeting—only to accept vague or incomplete responses. Their final recommendation was almost always the same: the licence may be granted. Approval was often conditional on applicants supplying further information, but the missing details were rarely provided. In the case of Stake, regulators questioned whether Vuckovic was really the sole owner and wanted him to provide information about his possible business relationship with Craven and Tehrani. The regulator granted the licence in 2024 without receiving those answers. With 1xBet, assessors suspected the company had multiple owners and wanted Hniedash to provide more information about his possible relationship with the three Russians identified as founders. Again, the regulator granted the licence without those answers.

Marcel Pheijffer, a professor of forensic accountancy at Nyenrode Business University in the Netherlands, analysed several of the regulator's assessments. He found that licences were granted even when important questions remained unanswered. "In the Dutch context, that approach would not be possible," he said. "In fact, I believe it should not be the case anywhere." He called it "incomprehensible" that the regulator had granted Stake a licence given the uncertainties over its ownership, and "remarkable" that the Curaçao Gaming Authority repeatedly grants licences before companies have provided important information. "This is a business that is highly susceptible to money laundering, particularly when it comes to transactions in cryptocurrencies," he added.

In response to the findings, the Curaçao Gaming Authority did not dispute that it had granted licences despite unresolved questions about ownership. Instead, it said the sector was going through a transition period. Curaçao passed a new gambling law in 2024 after nearly 30 years under a system in which the industry was mostly self-governed. The regulator said companies had been given time to meet the requirements step by step, and that its guiding principle was not to immediately refuse a licence whenever there was a question or uncertainty. Pheijffer rejected this justification. "A regulator must think first and then act," he said. "And not—as is the case here—the other way round." Jan van Koningsveld, an expert in offshore finance, said Curaçao's new gambling legislation is clear: regulators must establish, as far as possible, the identity, existence, and involvement of all owners and decision-makers. Concealed ownership creates significant money laundering risks and could allow organised crime networks to influence companies or become their owners. Björn Fuchs, chairman of the Dutch online gambling trade association VNLOK, said Curaçao's new law appeared to be "failing miserably" and called for tougher checks on ownership, integrity, and financial health, with licences refused when red flags remain unresolved.

Wittmann, the hacker who obtained the documents, compared her work to undercover journalism. She said she was motivated by the fact that she had rarely encountered a Curaçao-based gambling company operating entirely within the law. "So I decided it was important enough for us as a society to know who owns these companies," she said. The investigation, called Casino Secrets, was conducted in coordination with Follow the Money and media partners in Norway, Germany, Austria, and Sweden. It has exposed the identities of about 800 owners of nearly 650 licensed gambling firms. What happens next depends on whether regulators in Curaçao and elsewhere treat the revelations as a reason to finally enforce the rules they have written.