ACR Poker Bots: What the Record Proves vs. What's Myth

By Raul Moriarty · Updated 28 May 2026 · 12 min read

Most of what gets said about bots and "hacks" on ACR is invented. A surprising amount is documented. This page separates the two — what the public busts, refunds and statistics actually establish, versus the "ACR Poker hack" fantasy — using the one time a genuine breach really happened in poker, the UltimateBet 2007 superuser scandal, as the measuring stick.

What the public record actually establishes

Start from evidence, not search queries. The documented facts about bots on ACR are narrow but solid. There was a 2015 ring of roughly thirty accounts that WPN confiscated and refunded — about $1.4M back to affected players. There were quieter cleanups in 2019 and 2020 without dollar figures. The community forensics that surfaced these rings, and WPN's own statements confirming them, agree on one thing: the busted operations ran ordinary automated play. Solver-anchored decisions, opponent profiling, a UI that clicks. No exploit, no stolen cards, no broken deck.

That is the whole proven inventory. Everything outside it — server breaks, hole-card peeks, RNG prediction — has never appeared in a single documented ACR case. The sections below explain why, architecturally, those things cannot exist as a sold product, and then return to what the busted rings were genuinely made of.

The "hack" myth, sorted into its claims

"ACR Poker hack" is not one thing; it is five different claims with five different threat models, and only one of them describes anything real. Sorting them is the fastest way to see which side of the proven/myth line each falls on.

Three of the five are architecturally impossible or economically absurd as a sold product — and, tellingly, absent from every documented ACR case. One is real but against the rules. The fifth is what the busts were actually made of, which is why the rest of this page treats it as the real subject.

Why there has never been a server exploit to sell

WPN's architecture is the standard separation every modern operator uses. The client is a display layer; authoritative game state lives on operator servers and is validated there. Card data is generated server-side, encrypted in transit, and only revealed to a seat entitled to see it. The client never holds cards it should not — so decrypting the client's traffic buys nothing even if it works. There is simply no opponent hole-card data on your machine to steal.

The economics finish the argument. A genuine remote-code-execution flaw inside a poker operator is worth six figures through coordinated disclosure, or low seven figures through quiet personal use — with real jail risk attached. Neither path runs through a Telegram landing page with crypto checkout. A buyer of a "$200 server exploit" gets a wrapped bot, a credential stealer, or nothing. This is not speculation: in the entire documented history of ACR busts, the thing being caught is always automated play, never an exploit. The lone genuine breach in poker — covered below — was internal, and it took years to surface precisely because it never touched a customer's machine.

Why the deck cannot be predicted

The "predict the next board card" claim has the cleanest theoretical dismissal, but the shadow of the iPoker 2013 case still falls across the topic. iPoker 2013 was an implementation bug in a specific shuffling routine that produced statistically detectable deterministic patterns over a measurable sample. It was a real flaw on a real network years ago — and the network closed it within weeks. The lesson is bounded: a careless implementation can be broken; that does not generalise to a network that has done its CSPRNG work correctly.

Modern shuffling uses a cryptographically secure pseudo-random number generator, seeded by multiple entropy sources (hardware RNGs, accumulated user-interaction timing, OS randomness) and re-seeded under defined conditions. The shuffle is computed server-side and committed before any card information leaves the server.

CSPRNG output rate:        ~10^9 bits/sec (theoretical)
Information via poker:     ~50 bits/hand x ~300 hands/hour
                           = ~15,000 bits/hour = ~4 bits/sec
Attack ratio:              ~2.5 x 10^8 : 1

A CSPRNG's internal state is not reconstructible from a stream attenuated by eight orders of magnitude. No equivalent of the iPoker bug has been demonstrated against a modern operator since, and none has ever appeared in an ACR case.

The one breach that was real: UltimateBet 2007

To see what a true hack looks like — and why nothing on ACR matches it — look at the only documented case where someone genuinely saw opponents' hole cards: the UltimateBet and Absolute Poker scandals of 2007–08. Insiders with administrative access used a "godmode" view of live hole cards to grind impossible winrates for an extended period. That is the real article. Every "ACR hole card hack" listing is selling a fantasy of what UB insiders actually had.

But the details cut against the seller's pitch, not for it. The UB breach was not external software — it was an internal feature abused by privileged employees, invisible to anyone outside the company. And what exposed it was not a counter-hack; it was forensics. Community analysts noticed accounts winning at long-sample rates no human could sustain, pulled the hand histories, and the impossible statistics did the rest. The breakthrough was the same kind of hand-history evidence that later caught the 2015 ACR bot ring. A breach this severe still got caught — by reading the data.

Two things changed permanently after UB. Operators stripped administrative hole-card visibility from production and started instrumenting their own staff accounts; the legal and reputational cost of maintaining such a surface stopped being survivable. And the contrast with ACR is the whole point of this site: UB hid a real breach for years and lied about it; WPN catches ordinary bots and announces it, dollar figures and all. The parsimony test on any "hole-card view of ACR" offer writes itself — would WPN burn its licence, its US-facing player base and its principals' freedom to rent godmode for a few thousand a month, after watching exactly that destroy UltimateBet? The question answers itself.

What the busted rings actually ran

Strip the myth away and the thing every documented ACR ring was actually running is unglamorous: decision-support software playing the visible game state. This is what the 2015 KhanZ accounts were, once unwrapped — not an exploit, four ordinary components.

Solver-anchored baseline

Pre-computed strategies for high-frequency decision points, derived offline using CFR variants. Pluribus (Brown & Sandholm, 2019, Science) is the reference at superhuman level in 6-max NLH. The production problem is compressing those outputs to a real-time query budget — a separate problem from generating the strategies.

Online opponent model

Bayesian updates on per-opponent statistics (VPIP, PFR, 3-bet by position, fold-to-cbet by board texture). On ACR this benefits from fixed screen names — the same property that makes PT4 and HM3 work. The trade-off is that the operator gets the same long-horizon signal back, which produced the 2015 bust.

Policy combiner

Decides how far to deviate from the baseline given the current opponent estimate, and overlays detection-aware behavioural noise. The optimum is not zero detection score — it is the EV-maximising point under a budgeted detection probability over the account's lifetime.

UI automation layer

Reads the rendered client (screen scrape or accessibility tree on desktop) and emits clicks with behaviourally-shaped latencies. The least interesting layer mathematically, and the one that breaks most often — ACR ships client updates two to four times a year.

None of it is magic. It is software competing in a game, not breaking a game — and the 2015 ring proves it, because what got caught was exactly this stack playing too cleanly, not an exploit that needed patching. The edge comes from playing visible state consistently over long sessions, which is also precisely where the hand-history evidence is strongest. That tension is the whole story of the busts.

Why the myth keeps paying

Two questions dissolve the whole "hack" category. If a working server exploit existed for $99, why sell it widely instead of quietly printing millions with it? If a live hole-card peek existed, why dilute it across thousands of buyers and multiply the detection risk — turning a silent money-printer into a public product that gets it patched? In both cases the act of selling falsifies the thing being sold. UB insiders understood this perfectly: they never sold their godmode. They used it quietly and still got caught.

The myth survives anyway for three reasons. Losing players want a one-button answer that skips the work. The cost of a convincing landing page — generated copy, stock testimonials, Telegram automation, crypto checkout — is now near zero, and one operator runs dozens of brand names at once. And the audience self-selects for people who read the existence of a sales page as proof of a product. What the buyer actually receives is one of three things: a repackaged generic engine, a credential-stealer that drains the balance to a wallet, or silence after payment.

What the record still hides

The proven facts leave real gaps — questions the public busts raise but do not answer, where the truth is genuinely unknown rather than mythical:

1. How many rings were never announced? The 2019–2020 cleanups came without figures. We have no idea whether the 2015 ring was typical or exceptional in size, or how much enforcement happens with no public statement at all.
2. How sophisticated were the busted engines, really? The public account says "bots." It does not say whether the KhanZ accounts ran modern solver baselines or something cruder that simply played consistently enough to flag. The capability bar that actually got caught is unknown.
3. Did any ring ever evade long-term? By definition we only have data on the rings that got caught. Whether a more careful operation could have stayed inside the population envelope on ACR indefinitely is the one thing the bust record structurally cannot tell us.
4. How much did the refund actually cost WPN? Returning ~$1.4M to identifiable opponents is a deliberate, public move. Whether it was a net cost or a marketing investment that paid for itself in deterrence is an open question about the economics of transparency itself.

Continue with the step-by-step reconstruction of the 2015 bust, or the overview of why ACR is the rare room you can study from real cases at all.