GGPoker continued operations in Ukraine despite criminal cases and million-dollar crypto flows

Despite numerous criminal proceedings and public scandals, one of the world's largest online poker platforms, GGPoker, continued active operations. Investigations indicate that the company used its official licence as a facade, while actual financial flows, estimated at tens of millions of dollars, passed through cryptocurrency wallets and mirror sites, particularly in Ukraine.

Ownership structure and global ambitions

GGPoker is part of GGNetwork, which also includes the brands Natural8, PokerOK, and ClubGG. The parent company is Canadian NSUS Group Inc., whose ultimate beneficial owner is South Korean citizen Mansoo Kim (Mansoo «Michael» Kim). In 2024, NSUS Group acquired the World Series of Poker (WSOP) brand from Caesars Entertainment for approximately $500 million.

The platform holds licences in several jurisdictions, including the United Kingdom, Malta, and the Canadian province of Ontario. Meanwhile, numerous allegations have accumulated around GGPoker: from systematic fraud at high limits to illegal operations in Ukraine and potential links to the Russian gambling market.

Software compromise scandal and tool ban

In 2025–2026, a large-scale incident occurred involving the tampering with updates of third-party poker software (Jurojin, IntuitiveTables). Malicious actors installed a remote-access agent (Mesh Agent), giving them real-time access to players' screens and their hole cards. Dozens of high-stakes players were affected, with damages estimated in the hundreds of thousands and millions of dollars. Among the key accounts associated with this scheme is Paul Gregg; accounts on CoinPoker and Winning Poker Network are also mentioned.

GGPoker's response was strict: the company completely banned third-party software, including PokerTracker, Hold’em Manager, and various HUD tools, introducing additional protective measures such as screen guard and win-rate anomaly detection. GGPoker stated that it tracked part of the funds to a crypto wallet and contacted Coinbase. Critics note that the platform had allowed the use of such tools for years, and changes occurred only after widespread publicity.

Bryn Kenney's lawsuit against NSUS Group

In October 2026, prominent player Bryn Kenney (one of the leaders in tournament earnings) filed a lawsuit against NSUS Group and Mansoo Kim in a Nevada state court (USA). According to the plaintiff, in 2018 he was promised regular commissions from recruited agents and a 5% share in the business in exchange for promoting the platform. Kenney claims that in 2019 he earned $5 million in commissions, but his system was later "cut off," and the promised share was never provided.

Separately, Kenney accuses Kim of being aware of systemic fraud issues, assuring him of the reliability of security, and then shifting responsibility. The lawsuit mentions an episode where Kenney allegedly personally paid out $1 million to players after the company failed to settle $6 million. The lawsuit includes demands for compensation and punishment, while the defence seeks dismissal. These statements are merely allegations within a civil process, not proven facts.

Other episodes regarding game integrity were also recorded: ban lists for real-time coaching (the Ren Lin / RealOA case on GGMillion$) and ghosting (account substitution during a tournament). The company responded to such cases with public bans and redistribution of prize money.

Ukrainian trail: licence, mirrors, and criminal cases

In Ukraine, GGPoker operated through LLC "NSUS UA" (EDRPOU 43503124, since 2020, founder — NSUS Group Inc.). The company obtained an online poker licence in August 2021. However, according to investigations (including BlackBox OSINT), the licensed site ggpoker.ua barely functioned as a full-fledged platform. Actual gameplay took place through mirrors (ua1.ggpoker.com, ua5.ggpoker.com, ua7.ggpoker.com, ggpoker.in.ua, etc.) and mobile applications.

PokerOK (formerly GGPokerok) and ClubGG operated separately. According to the investigation, these platforms were used for illegal gambling for real money, including Telegram bots for deposits and withdrawals in crypto and cash. The financial indicators of "NSUS UA" appear disproportionate: with declared turnovers, profits are minimal or losses are recorded. For example, in 2024, revenue was approximately UAH 18 million, with a profit of only ~UAH 26,000.

Several criminal proceedings have been opened in Ukraine, including No. 72022000400000003 dated 19.09.2022, and other cases from 2022–2023, as well as mentions of new materials from the Bureau of Economic Security (BES) in 2025 regarding GGPoker/PokerOK. Charges include tax evasion (Art. 212 of the Criminal Code), illegal gambling business (Art. 203-2), violation of intellectual property rights, and money laundering (Art. 209). Among the defendants are former director Ihor Kalyahin, accountant Nataliia Hryvnak, current director Oleh Rachuk, and Russian citizen Ivan Bryksin (Брыксин).

Ivan Bryksin's role and links to Russia

According to case materials, in 2022 a search was conducted at the residence of Bryksin, who lived near Kyiv: equipment, documents, and a significant amount of cash (hundreds of thousands of dollars and euros) were seized. He is linked to the Russian-speaking part of the network (PokerOK).

In October 2026, Polish TV channel TVP Info published an investigation discussing bypassing blocks, attracting Polish players, and potential links to Russian gambling (specifically through Pin-Up and affiliates). The materials state that Bryksin moved to Russia and manages part of the operations from there. It is also mentioned that Ukrainian authorities allegedly confiscated large sums (billions of hryvnia are cited in publications in the context of related schemes), and there are requests to the State Financial Monitoring Service and ARMA.

BlackBox OSINT additionally points to significant crypto flows (tens of millions of dollars through Binance and other wallets in 2018–2022). According to the investigation, this allowed hiding actual turnovers and withdrawing funds, including to Russia and occupied territories. After the opening of criminal cases, operations reportedly did not cease — new domains and rebrandings were used.