A company bought for one hundred dollars. More than two billion dollars of revenue a year. A profit of a hundred and thirty-nine thousand. Six hundred and forty-five million dollars of crypto in wallets labelled with other people's names. And a regulator that wrote all of this down, asked the right questions, and granted the licence anyway.
These are not allegations from a rival or a disgruntled gambler. They come from the licence file of Medium Rare N.V., the Curaçao company that operates Stake.com, as submitted to and assessed by the Curaçao Gaming Authority. The file surfaced in September 2026 in the #CasinoSecrets leak. Le Détroit has analysed its 54 files one by one.
This report does three things. It explains, for a general reader, how an online casino can be used to launder money. It explains, for a compliance professional, why Curaçao's licensing system has made that risk hard to control. And it reads Stake's file the way a bank's financial crime team would read a client file: line by line, looking for what is there, what is missing and what does not add up.
PART I
How an online casino launders money
Money laundering has three classic stages. Placement puts criminal money into the financial system. Layering moves it around until its origin is hard to trace. Integration brings it back as money that looks clean. An online casino can do all three in a single afternoon, because it offers something no other business does: a legitimate reason for money to change hands without any goods or services changing hands.
The European Commission rates the risk accordingly. Its 2022 supranational risk assessment put money laundering in online gambling at "very high", the highest level on its scale, citing the absence of face-to-face contact, huge and complex volumes of transactions and the close link to e-money and digital currencies. Land-based casinos, by contrast, were rated medium.
Eleven ways money moves through an online casino
PART II
Curaçao: the licence that isn't one
Curaçao is a self-governing country within the Kingdom of the Netherlands, with about 160,000 inhabitants. According to the #CasinoSecrets consortium, it hosts more than 8,000 licensed casino domains. Its licences do not even authorise gambling in Curaçao itself, and almost no other government recognises them. Their value lies elsewhere: they open doors to payment firms and game studios that, according to Follow the Money, often treated the licence as sufficient grounds to work with an operator.
For decades, the government granted master licences to a few private companies, which sold sub-licences with virtually no state supervision. Under pressure from the Netherlands, Curaçao adopted the National Ordinance on Games of Chance (LOK), in force since 24 December 2024. It turned the former Gaming Control Board into the Curaçao Gaming Authority (CGA), which now licenses operators and suppliers directly, with requirements on economic substance, AML and reporting.
What the international evaluators found
Six months before the LOK took effect, assessors from the Caribbean Financial Action Task Force (CFATF) visited Curaçao, from 17 to 28 June 2024. Their report, adopted on 29 May 2025 and endorsed by the FATF, rated Curaçao's effectiveness on eleven "immediate outcomes".
The two ratings that matter most for online casinos, supervision and beneficial ownership, are the two Curaçao scored lowest.
A regulator breached through its own front door
The leak itself is a finding. According to Follow the Money, researcher Lilith Wittmann registered on the CGA's licensing portal in December 2025 under the name of a trust-office manager known to the regulator, using her own Gmail address and a fictitious applicant called "DreamCatcher Private Foundation". She was granted access within days, then uploaded software that gave her control of the portal and its documents. She later said that she and her collaborators had spent nine months inside the regulator's systems. The CGA acknowledged the unauthorised access on 17 September 2026, said it had contained the breach, and said a forensic investigation was under way.
An authority that could not verify the identity of a portal user is the same authority asked to verify the identity of casino owners. The CGA has said the sector is in a transition period, that the Minister of Finance chose to phase requirements in step by step, and that its guiding principle was not to "immediately refuse a licence" whenever there is a question or uncertainty. It has also issued its first dedicated crypto policy for licence holders, with full compliance due by mid-2027.
PART III
Inside the Stake file
Stake was launched in 2017 and grew into one of the most visible gambling brands in the world, with sponsorships in Formula 1, football and the UFC and the rapper Drake as its figurehead. Its operating company, Medium Rare N.V., is registered in Curaçao under number 145353. For years it operated under a sub-licence from the master licence holder Antillephone. In 2024 it applied to the regulator directly under reference OGL/2024/1451/0918.
The file contains 54 files: application and corporate forms in several versions, the regulator's working papers and final report, the licence and its extension, AML, KYC and security policies, an operations manual, a business plan, a crypto wallet statement, monthly ledgers for 2021 to 2023 and financial statements for 2024 and 2025.
1. The licensing timeline
2. Who owns Stake? On paper, and in the books
The application names one person as the sole ultimate beneficial owner: Mladen Vučković, publicly known as Stake's chief executive. The certified structure chart shows him holding 100% of Medium Rare N.V., with a Curaçao trust company, Xecutive Corporate Management B.V., as statutory director.
The regulator's reviewers were not convinced. Their final report notes that the declared owner stated his net worth in a band recorded as "USD < 1 billion", evidenced only by a bank letter showing a balance of about USD 75,000, and that a self-certified source-of-wealth declaration stated that USD 100 was used to purchase the company. The business plan itself describes the company as "legally owned" by him, and presents him as a former head of customer support at Primedice, the dice site that the regulator's report says is referred to online as a creation of Craven and Tehrani. The report also records that public sources consistently name Ed Craven and Bijan Tehrani, the Australian co-founders of the games developer Easygo, as Stake's founders.
The accounts tell a different story from the structure chart. The draft balance sheets for 2021 to 2023 contain accounts labelled with the names of Stake's publicly known founders and their companies: "Profit entitlement-Easygo" and "Profit entitlement-Bijan", "Partner loan-Easygo" and "Partner Loan-Bijan", "IP Offsetting" for both, and intercompany balances with Primedice, Easygo, Sweepsteaks (the Cyprus company behind the US site Stake.us), Well Done STK and Mebit, a Serbian company owned by the declared owner that provides customer service.
The regulator drew the same connection. Its fourth licence condition required the company to explain, within five weeks, its "connection and business/contractual arrangements" with Ed Craven, Bijan Tehrani, Easygo, Primedice, Sweepsteaks, Mebit and Well Done STK, and the agreements covering the Stake brand and domain. According to Follow the Money, the regulator's officials identified loans and payments worth tens and sometimes hundreds of millions of dollars from Medium Rare to companies and individuals linked to the two founders.
A year after that condition was set, the corporate information form dated 14 May 2026 still declares a single owner, now holding 100% through a company named "Lockwood". No document in the file sets out the explanation the regulator asked for.
3. Billions in revenue, almost no profit
The draft ledgers, titled "Profit and Loss New Draft", show monthly revenue of between roughly $94 million and $307 million. Over a full year, revenue exceeded $2.4 billion in 2022and $2.3 billion in 2023. Profit, after expenses, came to a few tens of thousands of dollars.
Where does the money go? The 2023 ledger answers in detail. Of $2.19 billion of expenses, about $1.38 billion is booked as "Retention": manual bonuses ($455 million), coupons ($487 million), "faucet/reloads" ($276 million), rakeback ($102 million), races ($53 million), and smaller lines named "Tip" and "Rainbot". A further $222 million appears as "Partnership Expense". Staff salaries, by contrast, total only $2.8 million: the operations are carried out elsewhere, notably by the Serbian service company, described in the business plan as a team of 300.
Meanwhile, the balance sheets carry the two "profit entitlement" accounts, always of identical size, and the partner loans.
The later statements look different. The 2024 statements show revenue of $1.99 billion and profit of $2.3 million; 2025 shows $1.86 billion and $48.9 million, with $43.4 million of dividends paid. Tax is zero in both years: the notes explain that under Curaçao's territorial system, foreign-source income is taxed at 0%. The statements describe themselves as prepared under IFRS, but no independent auditor's report appears in the file, although the regulator had asked for audited accounts.
4. Whose wallets hold the money?
To show its source of funds, the company submitted a one-page statement titled "Stake 2024-03-22 USD". For each of about thirty currencies, it lists balances in a "Hot Wallet & PSP" column and two cold-storage columns: "Cold Wallet by Bijan" and "Cold Wallet by Easygo". It deducts user balances, active bets and bonuses owed, and arrives at $677,625,519.66.
By Le Détroit's calculation, about $645 million, or 83% of gross holdings, sat in the two cold-wallet columns labelled with the names of Easygo and "Bijan", including most of the bitcoin and ether. The regulator noticed: it wrote that the statement "does not specify that the wallet is that of the applicant", and that it could not verify how player funds were segregated.
Two further details stand out. The statement includes Japanese yen balances, including about ¥198 million owed to users, although yen is not among the fiat currencies declared in the application; Japan does not license online casinos. And the corporate form of May 2026, asked to list the company's virtual asset wallets, answers: "to be provided upon request".
5. The controls on paper
The file contains the policies of a mature operator: an AML/CTF policy, a KYC policy, an information security policy, a responsible gambling policy and an operations manual. They describe screening of every crypto deposit and withdrawal through Chainalysis, identity checks through Veriff, sanctions screening, device fingerprinting to detect multiple accounts, VPN detection, and restrictions on peer-to-peer transfers. Those are real controls. The question is how consistently they are described.
One screenshot in the file shows the operator's account on goAML, the platform through which Curaçao's financial intelligence unit receives unusual-transaction reports. The organisation was created on 16 June 2025, a week after the provisional licence took effect, and is registered under the agency type "Casinos (Landbase)".
6. Nine conditions, and what the file shows afterwards
The regulator's recommendation was clear: "The license is granted subject to special license conditions." The report also notes that the usual independent reviewer declared a conflict and that a second reviewer made the recommendation. The nine conditions were issued in February 2025.
7. Outside Curaçao
The ledgers link this US exposure back to Curaçao. At the end of 2023, Medium Rare N.V. recorded an intercompany receivable of about $21 million from, and a payable of about $31 million to, "Sweepsteaks", the Cyprus company behind Stake.us. For a bank, flows between an offshore real-money casino and a US-facing sweepstakes operator under state scrutiny are a relationship to map, not to assume away.
PART IV
A bank-grade risk assessment
How would a bank, a payment institution or a crypto exchange rate Medium Rare N.V. as a counterparty on the basis of this file alone? The matrix below applies a standard risk-based approach: inherent risk by factor, the mitigants the file documents, and the residual concern.
Taken alone, most of these points have an innocent explanation. Taken together, they describe a counterparty whose owner, money and custody a bank cannot verify from what the regulator was given.
PART V
Red flags and monitoring scenarios
Banks rarely hold an offshore casino's operating account. They meet the sector indirectly: through payment institutions, crypto exchanges, affiliates, streamers, sponsors, game studios, trust companies, and the players themselves. Each of these is a point where money from an unlicensed market can enter the regulated system.
PART VI
Recommendations
For the European Union and AMLA
For Curaçao and the Curaçao Gaming Authority
For the Kingdom of the Netherlands
For banks, payment institutions and crypto platforms
For operators that want to be trusted
ANNEX
Method, documents and limits
