Back
Automatically translated version. May contain inaccuracies compared to the original.
The international poker network GGPoker has found itself at the center of new allegations concerning the safety of online gaming, operations in Ukraine, possible evasion of blocks, and financial ties to Russia. In October 2026, attention to the platform was drawn by a civil lawsuit filed by professional player Brin Kenny against its parent NSUS Group Inc. and its ultimate beneficial owner Kim Mansu, as well as journalistic investigations into Ukrainian operator LLC NSUS UA and Russian citizen Ivan Briksin. The claims involve possible fraud, tax violations, and use of cryptocurrency transfers, though not all assertions have been proven by court decisions.
GGPoker is part of GGNetwork, which also includes the Natural8, PokerOK, and ClubGG brands, according to media reports. The parent company NSUS Group Inc. is registered in Canada, and its ultimate beneficial owner named in the provided materials is South Korean citizen Kim Mansu, also known as Michael Kim. In 2024 year NSUS Group acquired the World Series of Poker (WSOP) brand from Caesars Entertainment for approximately $500 million. The scale of the deal contrasts with questions that have arisen around control of play, financial transparency, and the operation of individual network units. In 2025–2026 years, the international poker market was rocked by reports of compromise of third-party software Jurojin and IntuitiveTables. According to the disclosed version of events, substituted updates could install a remote agent Mesh Agent, which granted attackers access to players’ screens and hole cards during deals. Among the potential victims were dozens of high-stakes players, and total losses were estimated in the hundreds of thousands or millions of dollars. One of the key accounts associated with the alleged scheme was linked to the name Paul Gregg; accounts on CoinPoker and Winning Poker Network were also mentioned. After the publicity, GGPoker banned third-party poker programs, including PokerTracker, Hold’em Manager, and HUD tools, and announced additional safeguards, anomaly checks, and a screen guard. The company said it tracked part of the funds to a cryptocurrency wallet and contacted Coinbase. Critics asked why restrictions were imposed after the public scandal if the use of third-party tools had been widespread earlier. The fully independently verified list of affected parties and the final amount of losses were not provided in the materials. In October 2026, professional player Brin Kenny filed a lawsuit against NSUS Group and Kim Mansu in a Nevada court. According to Kenny, in 2018 year he was promised regular commissions for recruiting players and agents, as well as 5% equity in the business for promoting the platform. The plaintiff claims that in 2019 year he earned about $5 million in commissions, after which the terms of cooperation changed, and the promised stake he never received. Kenny also accused Kim Mansu of allegedly knowing about problems with fraud on the platform but assuring the reliability of the protections. The suit also mentions an episode of payouts to players: according to the plaintiff, after the company failed to fulfill its obligations in $6 million, he personally paid participants $1 million. The defendants seek to dismiss the suit. These statements are contested civil claims and cannot be regarded as proven facts at the conclusion of litigation. The Ukrainian direction of the network’s activity is linked to LLC NSUS UA, registered in 2020 year and founded by NSUS Group Inc. In August 2021 year the company received a license for online poker. According to BlackBox OSINT’s investigation, the licensed site ggpoker.ua, according to the authors, did not provide full platform functionality, while access to games was carried out through other domains and applications. Among the cited addresses are ua1.ggpoker.com, ua5.ggpoker.com, ua7.ggpoker.com, and ggpoker.in.ua. Separately in the materials are PokerOK and ClubGG, which the investigation, per the reports, examined for organizing illegal games for money.
The financial reporting of LLC NSUS UA also became a subject of questions. According to the cited data, in 2024 year the company’s revenue was about 18 million UAH, and profit about 26 thousand UAH. Low profit in itself does not prove concealment of income, but to assess real turnover one must compare the licensed operator’s reporting with cash movements through related platforms, payment channels, and cryptocurrency wallets. In Ukraine there are criminal proceedings, including No. 72022000400000003 dated 19 September 2022 year, as well as materials 2022–2023 years and reports on new checks by the State Bureau of Investigation in 2025 year. The publications discuss possible tax evasion, illegal organization of gambling, infringement of intellectual property rights, and legalization of income. Among the individuals mentioned in the materials are former director Ihor Kalyahin, accountant Nataliya Hryvnak, and director Oleh Rachuk. The presence and procedural status of each episode would need to be verified from the materials of the respective proceedings. The investigators also paid particular attention to Ivan Briksin — a Russian citizen who is associated in publications with the Russian-speaking PokerOK brand. According to the data, in 2022 year near Kyiv where he resided, a search was conducted during which equipment, documents, and substantial amounts of cash in dollars and euros were seized. Polish television channel TVP Info published in October 2026 a report on possible evasion of blocks and ties of parts of the gambling business with Russian structures. The materials also mentioned Pin-Up and affiliated projects. At the same time, the specific extent of proven ties between Briksin, GGPoker, and Russian operators requires documentary confirmation. BlackBox OSINT also reported cryptocurrency transfers totaling tens of millions of dollars through Binance and other wallets in 2018–2022 years. According to investigators, such operations could complicate establishing actual turnover and money routes, including possible transfers to Russia and to occupied territories. The authors contend that after investigations were opened, activity could continue through new domains and changed brands. To substantiate these conclusions, blockchain analysis data, wallet owner identification, and results of financial monitoring are needed. The key questions remain the actual turnover of the Ukrainian operator, the role of related platforms, the origin of cryptocurrency flows, and possible contacts with the Russian gambling business. Answers should be based on materials from criminal proceedings, financial reporting, and court rulings, and not solely on coincidences of corporate links. Until the relevant circumstances are established, accusations against specific individuals and companies should be treated as investigators’ versions or positions of parties, rather than proven facts.
Document: PDF proof of the original version of the news item "GGPoker: зв’язки з РФ, кримінальні провадження та криптопотоки". It records the publication content at the moment of the first scan, the preservation date and the source: Fraza.
