The global illegal gambling market now handles an estimated $5.9 trillion in annual wagers, according to Gaming Compliance International. In Britain alone, £2.7 billion is staked annually on unlicensed sites — money that bypasses the Gambling Commission's anti-money laundering checks, responsible gambling safeguards, and the 40% Remote Gaming Duty that licensed operators pay HMRC. The industry's growth is structural, not accidental: every regulatory tightening of legitimate operators creates a fresh incentive for users to move underground. The "Casino Secrets leak" — tens of thousands of confidential documents extracted by 31-year-old German hacker Lilith Wittmann over nine months of monitoring Curaçao's Gaming Control Board — offers the first systematic look inside these operations. Wittmann described the breach as trivial: six hours to find the vulnerability, then nine months of real-time surveillance. The files include ownership details, balance sheets, and source-of-wealth declarations for thousands of offshore casinos. In one case, a company's entire source-of-funds documentation consisted of a man writing "cryptocurrency investments" on a piece of paper. Curaçao sits at the centre of this architecture. The Caribbean nation hosts over 8,000 online casinos — one for every 20 residents — and has marketed itself as a jurisdiction offering just enough legitimacy for banks, payment processors, and game developers to justify doing business with these sites. The licence functions as what the Guardian's Rob Davies calls a "fig leaf of respectability": not meaningful oversight, but enough to make the financial plumbing work. As even Curaçao has marginally tightened its standards in recent years, operators have migrated to even lighter-touch jurisdictions: First Nation territories like Kahnawake and Tobique in North America, and the Indian Ocean island of Anjouan. The extraction runs in multiple directions simultaneously. Organised crime networks use opaque ownership structures and offshore licences to operate what amount to unregulated digital casinos with zero consumer protection. Users who display obvious signs of problem gambling receive no intervention. Some sites have simply refused to pay out winnings, and players have no legal recourse. Meanwhile, the UK Treasury loses its cut: betting and gaming duties are projected to raise £4 billion in 2025/26, but every pound staked offshore is a pound that avoids both Remote Gaming Duty and corporation tax. The regulated industry itself is complicit in blurring the lines. Premier League football clubs advertise offshore gambling operations on their kits — operations that are unlicensed in Britain. Users can reach unregulated sites without a dark web browser; many simply don't bother blocking UK access, and a basic VPN defeats those that do. The Gambling Commission found that many users cannot distinguish licensed from unlicensed platforms. The visual interface is identical; only the regulatory backstop differs. Britain is preparing legislation to give the Gambling Commission greater enforcement powers, but the structural asymmetry is stark. A shut-down casino can relaunch on a new domain within seconds. Jurisdictions can be swapped faster than international agreements can be negotiated. Davies draws the comparison to drug and sex trafficking — areas where massive coordinated global enforcement exists — and notes that nothing comparable exists for illegal gambling. Countries like Russia and Belarus have neither the will nor the incentive to cooperate. The leak's real value will emerge over months as specialist reporters cross-reference ownership data with known criminal networks. The Santeda network — which Davies has previously reported on as operating six or seven of the largest offshore casinos used in the UK — appears in the files. The documents expose not just individual bad actors but the systemic architecture: how global gambling networks gravitateto a single jurisdiction as a gateway to millions of wallets, and how that jurisdiction's oversight amounts to a rubber stamp.
