A searchable archive of more than 40,000 documents taken from the Curaçao Gaming Authority (CGA) went public on Sept. 23, 2026. Journalist Lilith Wittmann obtained the files through a nine-month breach of the regulator’s licensing portal. Reporting on the files ties roughly 1,000 casino domains to software supplier Softswiss, which says it runs no casinos. The CGA says it cannot confirm that grouping. The files cover crypto brands including Rollbit, 1xBet, Stake and Roobet, but the archive states that inclusion does not imply wrongdoing.
Journalists released more than 40,000 documents taken from the Curaçao Gaming Authority on Sept. 23, 2026, exposing ownership, funding and licensing records for hundreds of Curaçao-licensed gambling companies. The leak puts one of the crypto casino sector’s main licensing hubs under scrutiny. It’s centered on a claim that roughly 1,000 casino domains form one network linked to Softswiss, a claim both Softswiss and the regulator reject.
Protos reported that the documents include financial plans, audits, business structures and funding sources. The archive states that inclusion “does not imply illegal or improper conduct.” However, the sources give different counts.
Follow the Money said the files identify roughly 800 owners of nearly 650 licensed companies, while Protos put the figure at more than 1,000 casinos and gambling firms. We found reports saying whether player account data is in the archive.
Wittmann, a Berlin-based security researcher and journalist, first accessed the CGA’s licensing portal under an assumed identity in December 2025. She says she and partner journalists extracted almost 2TB of data from the Curaçao and Malta gambling authorities.
Follow the Money published the main investigation on Sept. 22 with Germany’s NDR, Norway’s NRK, Sweden’s SVT and Austria’s Jetzt.
The CGA confirmed unauthorized access on Sept. 17. It said it had contained the breach, identified its source and that a forensic investigation was underway.
Softswiss set out its position in a lawyer’s letter dated Sept. 9, which NDR’s STRG_F published. The company said it “operates no online casinos itself” and offers no gambling services to end users.
The letter argued that supplying software gives Softswiss no more control over its clients than Microsoft Office or Apple products do.
On Platincasino, a German-facing brand reportedly at the center of a Frankfurt prosecution, Softswiss said it may have supplied software components or access to game providers. But it said it did not run the brand.
A lawyer for Softswiss founder Ivan Montik confirmed he owned 100% of Dama N.V. and Topchik N.V. before selling them. The lawyer said Montik did not run either company.
The letter also argued that Germany’s licensing requirement for virtual slot machines is unlawful. So, in its view, a company licensed abroad does not break the law by accepting German players. It added that the companies involved have paid several hundred million euros in German gambling tax under protest.
The CGA told STRG_F it keeps no classification matching the Softswiss network. It said it could not confirm a grouping “which has been fabricated by you” and that a shared platform does not turn separate licensees into one regulatory network.
The regulator also said it does not help licensees get around site blocking. It said a Curaçao license “does not authorize an operator to conduct activities in Germany,” and that registering extra domains is not permission to target markets where a company cannot legally operate.
The CGA told Follow the Money it has rejected about 28% of applications since 2023. Mario Galea, whose Malta firm Random Consulting carries out due diligence for the CGA, told Jetzt that licensing decisions rest with the authority alone and denied facilitating illegal gambling.
The dispute tests two questions at the core of Curaçao’s licensing model. Does a shared technology supplier control the companies on its platform? And does a Curaçao license cover markets such as Germany?
Softswiss and the CGA both answer no to the first. On the second, the CGA says no, but Softswiss’s lawyers call the German rules unlawful.
The CGA’s license registry dated Sept. 21 lists seven of the named companies with indefinite licenses. They are Dama, Latiform B.V., Hollycorn N.V., Just Entertainment B.V., Topchik, 1xBet’s Caecus N.V. and Prolific Trade N.V., which runs Blaze.
The registry marks Medium Rare N.V., the company behind Stake, as “assessment in progress.” The CGA’s enforcement register lists 32 licenses revoked or not extended, including Qbet owner Novatech Solutions N.V., in May.
A Curaçao license costs about $54,400 a year. The CGA tightened its rules for crypto casinos in June.
Protos said the leak affects Rollbit, 1xBet, Stake and Roobet. An X user called “halfretired0” used the database to identify Rollbit’s owner as Daniel Dixon, known as “Lucky.” X has since suspended the account.
Protos described Rollbit as frequently accused of scamming customers and cited reporting linking Dixon to a 2016 CS:GO scandal involving predetermined dice rolls.
The files also cover Tether.bet, which Protos says runs under GT Holdings B.V. Protos linked the brand to George Cottrell, a close aide to Nigel Farage, and the records list Hon Kong Yong as beneficial owner.
One source of Tether.bet’s funding was the $3.7 million sale of Yong’s London apartment. The buyer was Peter A. Fanconi, chairman of BlueOrchard Finance.
Wittmann says the group tried other methods first and that the public interest outweighs how she obtained the data. The Malta Gaming Authority, whose systems she breached earlier this year, has brought an injunction case against her in a Berlin court.
The court postponed its ruling shortly before the reporting came out. The sources don’t say whether the CGA’s forensic investigation has ended.
Vladimir is a senior iGaming writer and editor, adept at breaking down the key details of crypto casinos and sportsbooks so players don’t have to, delivering honest, player-focused information that actually matters.
