Audit log

Every state-changing event for Shuffle (shuffle.com): moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-17 23:48:39Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 443,508,168

   sig

   4z9HBX78ALnC…kMyKFopKcopyexplorer ↗

   hash

   EqDQwPjPaVeM…w7cKJSV8copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (18408 B) ▸

   {"actor":"system:backfill","investigation_id":"abe68948-0c6d-437a-9c8a-629b64c141cd","kind":"publish","page_slug":"shuffle-shuffle-com","published_at":"2026-08-17T23:48:39.246Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Shuffle (shuffle.com)","sections":[{"content":"Shuffle (shuffle.com) is a crypto casino and sportsbook platform operated by Natural Nine B.V., incorporated in Curacao. The platform launched in February 2023 and was co-founded by Noah Dummett, an Australian entrepreneur and former Alameda Research and FTX employee, alongside Darcy Spangler and Harley Fresh. The platform was incubated by Fisher8 Capital, a crypto trading group. In March 2024, Shuffle issued its own ERC-20 governance and rewards token, SHFL. The platform reported processing over $2 billion in monthly wagers as of the time of its October 2025 data breach disclosure. Shuffle holds a Curacao Gaming Control Board license under license number OGL/2024/1337/0628, issued through Natural Nine B.V. Curacao-licensed gambling platforms operate under a jurisdiction that provides limited consumer protections compared to regulators in the United Kingdom, Malta, or the United States, and Curacao has no binding dispute resolution mechanisms enforceable in most player home jurisdictions.","heading":"Overview and Licensing","severity":"low","sources":[{"credibility":1,"name":"Shuffle Casino License Page","type":"official","url":"https://shuffle.com/info/license"},{"credibility":2,"name":"Shuffle.com Licence Decoded: What OGL/2024/1337/0628 Means — PotsOfGold","type":"research","url":"https://potsofgold.com/shuffle-curacao-license/"},{"credibility":2,"name":"Noah Dummett — Shuffle's founder profile on IQ.wiki","type":"other","url":"https://iq.wiki/wiki/noah-dummett"},{"credibility":2,"name":"Shuffle's Noah Dummett on his plan to outshine Stake — NEXT.io","type":"news_article","url":"https://next.io/news/features/shuffle-noah-dummett-plan-to-outshine-stake/"}]},{"content":"On October 10, 2025, Shuffle confirmed a data breach caused by unauthorized access to Fast Track, a Malta-based iGaming customer relationship management (CRM) platform that Shuffle used for email communications and customer data management. According to Shuffle founder Noah Dummett, the majority of the platform's user base was affected by the incident. Data exposed in the breach included full names, email addresses, home addresses, phone numbers, complete transaction histories, betting patterns, and customer support message logs. Critically, attackers also obtained KYC verification documents — copies of driver's licenses and passports — that users had uploaded to comply with Curacao eGaming identity verification requirements. Partial payment information (payment type and last four digits of card numbers) was also accessed. Shuffle stated that user account passwords, login credentials, and player funds were not part of the stolen data. Shuffle advised users to enable two-factor authentication and stated it would end its partnership with Fast Track in favor of an alternative CRM provider. Fast Track held SOC 2 Type 2 certification renewed in June 2025, though that certification did not prevent the breach. A second unnamed casino that was also a Fast Track client was confirmed to have been affected. No regulatory fines or enforcement actions arising from this breach have been publicly confirmed as of August 2026.","heading":"October 2025 Data Breach via Third-Party CRM Provider","severity":"high","sources":[{"credibility":2,"name":"Shuffle Data Breach: Major Crypto Casino Hit by Third-Party CRM Attack — Brave New Coin","type":"news_article","url":"https://bravenewcoin.com/insights/shuffle-data-breach-major-crypto-casino-hit-by-third-party-crm-attack"},{"credibility":2,"name":"Major Data Breach Hits Online Casinos Through Third-Party CRM Provider Fast Track — Breached.company","type":"news_article","url":"https://breached.company/major-data-breach-hits-online-casinos-through-third-party-crm-provider-fast-track/"},{"credibility":2,"name":"Shuffle Data Breach: Major Crypto Casino Hit by Third-Party CRM Attack — BitcoinEthereumNews","type":"news_article","url":"https://bitcoinethereumnews.com/crypto/shuffle-data-breach-major-crypto-casino-hit-by-third-party-crm-attack/"},{"credibility":3,"name":"Shuffle Casino Hack 2025: First Steps After a Major Data Breach — ltccasino.io","type":"news_article","url":"https://www.ltccasino.io/cryptocasino/shuffle-casino-data-breach/"}]},{"content":"On August 10, 2026, blockchain investigator ZachXBT published an investigation on X (formerly Twitter) alleging that a US-based individual, identified as Tiffany Milanovich, was tied to at least $5 million in crypto theft conducted through hardware wallet and centralized exchange support impersonation scams. According to ZachXBT's investigation, Milanovich allegedly gambled a victim's stolen funds on Shuffle while calling and mocking the victim on the phone. ZachXBT stated he reported the account to Shuffle, and Shuffle confirmed it reviewed the submitted evidence and that the account would be locked. The broader investigation alleged Milanovich acted as a 'caller,' impersonating exchange and wallet support staff to induce victims into surrendering access to their funds. One victim allegedly lost $1.2 million in Bitcoin and Ethereum from a compromised Trezor hardware wallet in June 2026; a separate incident in October 2025 allegedly involved roughly $500,000 stolen from a Coinbase account. The investigation also alleged links to John Daghita (known as 'Lick'), who had previously been linked by ZachXBT to approximately $46 million in crypto theft and was arrested in March 2026. ZachXBT's report is an investigative allegation, not a court filing or regulatory finding. No charges, indictments, or convictions against Milanovich had been publicly confirmed as of the date of this investigation, and Shuffle is described as the platform where the alleged gambling occurred — not as a perpetrator of the theft. Shuffle's stated response — locking the flagged account — is consistent with standard AML compliance behavior.","heading":"Association with Alleged Active Crypto Theft — ZachXBT August 2026 Investigation","severity":"high","sources":[{"credibility":2,"name":"ZachXBT on X — thread post 8 of investigation (Shuffle account lock confirmation)","type":"social_media","url":"https://x.com/zachxbt/status/2086785502750138684"},{"credibility":2,"name":"ZachXBT on X — thread post 1 of investigation (introduction of Tiffany Milanovich)","type":"social_media","url":"https://x.com/zachxbt/status/2086785482487456201"},{"credibility":2,"name":"ZachXBT Links U.S. Resident to Alleged $5M in Crypto Support Impersonation Thefts — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/08/10/zachxbt-links-u-s-resident-to-alleged-5m-in-crypto-support-impersonation-thefts/"},{"credibility":2,"name":"ZachXBT Names Tiffany Milanovich in Alleged Wallet and Coinbase Theft Network — CryptoPotato","type":"news_article","url":"https://cryptopotato.com/zachxbt-names-tiffany-milanovich-in-alleged-wallet-and-coinbase-theft-network/"},{"credibility":2,"name":"Alleged $5M Crypto Fraudster Tiffany Milanovich Dumps Telegram Usernames After ZachXBT Investigation — NullTX","type":"news_article","url":"https://nulltx.com/alleged-5m-crypto-fraudster-tiffany-milanovich-dumps-telegram-usernames-after-zachxbt-investigation"},{"credibility":2,"name":"ZachXBT Tiffany Milanovich Report: $5M Crypto Theft Claims — Blockwisely","type":"news_article","url":"https://blockwisely.com/news/zachxbt-tiffany-milanovich-crypto-theft-claims/"}]},{"content":"Independent player review platforms and gambling complaint forums documented recurring withdrawal hold issues at Shuffle as of July-August 2026. At least one documented complaint filed with AskGamblers described approximately $20,000 in withdrawals placed under compliance review since July 31, 2026, with the player completing requested KYC steps — including identity verification and a liveness check — but receiving only templated support responses with no resolution timeline. A recurring pattern in negative player feedback on Trustpilot and AskGamblers describes withdrawal holds triggered by KYC checks following large wins, multiple rounds of document and liveness requests, and support communications that go silent during extended review periods. Trustpilot reported it had made Shuffle's overall rating unavailable following a breach of its guidelines, citing identification of fake reviews. The polarized review distribution — approximately 54% one-star and 38% five-star out of roughly 1,072 reviews as of July 2026 — is consistent with patterns seen at platforms with significant high-roller dissatisfaction alongside satisfied recreational players. No regulatory enforcement action related to these withdrawal complaints has been publicly confirmed.","heading":"Withdrawal Complaints and Customer Service Issues","severity":"medium","sources":[{"credibility":2,"name":"Shuffle Casino — Withdrawal stuck under review for over 2 weeks — AskGamblers complaint","type":"community_report","url":"https://www.askgamblers.com/casino-complaints/shuffle-casino-withdrawal-stuck-under-review-for-over-2-weeks"},{"credibility":2,"name":"Shuffle Casino Review (2026) — Player Ratings and Our Verdict — AskGamblers","type":"research","url":"https://www.askgamblers.com/online-casinos/reviews/shuffle-casino"},{"credibility":3,"name":"Shuffle Reviews — Trustpilot","type":"community_report","url":"https://www.trustpilot.com/review/shuffle.com"}]},{"content":"Shuffle operates under Curacao Gaming Control Board license OGL/2024/1337/0628, held by Natural Nine B.V. The Curacao licensing regime provides significantly lower consumer protections than gaming regulators in the UK, Malta, or EU member states. The Curacao framework does not mandate independent dispute resolution, imposes less stringent AML requirements, and lacks robust enforcement mechanisms for players based outside Curacao. Players who experience account holds, withheld withdrawals, or data handling disputes have limited formal recourse compared to players at platforms licensed in stricter jurisdictions. No regulatory enforcement action by any gaming or financial regulator against Shuffle has been publicly reported as of August 2026.","heading":"Curacao Licensing and Consumer Protection Limitations","severity":"medium","sources":[{"credibility":1,"name":"Is Shuffle Casino Licensed? Curacao License Explained — Shuffle Official Blog","type":"official","url":"https://shuffle.com/blog/is-shuffle-casino-licensed-curacao-license-explained"},{"credibility":2,"name":"Shuffle Casino Review 2026 — Bonus, Games, Payouts — CryptoSlate","type":"research","url":"https://cryptoslate.com/crypto-casinos/shuffle-casino-review/"}]}],"sources_used":[{"credibility":2,"name":"ZachXBT on X — Shuffle account lock confirmation (thread post 8)","type":"social_media","url":"https://x.com/zachxbt/status/2086785502750138684"},{"credibility":2,"name":"ZachXBT on X — Tiffany Milanovich investigation introduction (thread post 1)","type":"social_media","url":"https://x.com/zachxbt/status/2086785482487456201"},{"credibility":2,"name":"ZachXBT Links U.S. Resident to Alleged $5M in Crypto Support Impersonation Thefts — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/08/10/zachxbt-links-u-s-resident-to-alleged-5m-in-crypto-support-impersonation-thefts/"},{"credibility":2,"name":"ZachXBT Names Tiffany Milanovich in Alleged Wallet and Coinbase Theft Network — CryptoPotato","type":"news_article","url":"https://cryptopotato.com/zachxbt-names-tiffany-milanovich-in-alleged-wallet-and-coinbase-theft-network/"},{"credibility":2,"name":"Alleged $5M Crypto Fraudster Tiffany Milanovich Dumps Telegram Usernames After ZachXBT Investigation — NullTX","type":"news_article","url":"https://nulltx.com/alleged-5m-crypto-fraudster-tiffany-milanovich-dumps-telegram-usernames-after-zachxbt-investigation"},{"credibility":2,"name":"ZachXBT Tiffany Milanovich Report: $5M Crypto Theft Claims — Blockwisely","type":"news_article","url":"https://blockwisely.com/news/zachxbt-tiffany-milanovich-crypto-theft-claims/"},{"credibility":2,"name":"ZachXBT Traces $5M Crypto Thefts to US-Based Support Impersonation Scammer — BeInCrypto via Yahoo News","type":"news_article","url":"https://www.yahoo.com/news/us/articles/zachxbt-traces-5m-crypto-thefts-051519967.html"},{"credibility":2,"name":"Shuffle Data Breach: Major Crypto Casino Hit by Third-Party CRM Attack — Brave New Coin","type":"news_article","url":"https://bravenewcoin.com/insights/shuffle-data-breach-major-crypto-casino-hit-by-third-party-crm-attack"},{"credibility":2,"name":"Shuffle Data Breach: Major Crypto Casino Hit by Third-Party CRM Attack — BitcoinEthereumNews","type":"news_article","url":"https://bitcoinethereumnews.com/crypto/shuffle-data-breach-major-crypto-casino-hit-by-third-party-crm-attack/"},{"credibility":2,"name":"Major Data Breach Hits Online Casinos Through Third-Party CRM Provider Fast Track — Breached.company","type":"news_article","url":"https://breached.company/major-data-breach-hits-online-casinos-through-third-party-crm-provider-fast-track/"},{"credibility":3,"name":"Shuffle Casino Hack 2025: First Steps After a Major Data Breach — ltccasino.io","type":"news_article","url":"https://www.ltccasino.io/cryptocasino/shuffle-casino-data-breach/"},{"credibility":2,"name":"Shuffle Casino — Withdrawal stuck under review for over 2 weeks — AskGamblers complaint","type":"community_report","url":"https://www.askgamblers.com/casino-complaints/shuffle-casino-withdrawal-stuck-under-review-for-over-2-weeks"},{"credibility":2,"name":"Shuffle Casino Review (2026) — Player Ratings and Our Verdict — AskGamblers","type":"research","url":"https://www.askgamblers.com/online-casinos/reviews/shuffle-casino"},{"credibility":3,"name":"Shuffle Reviews — Trustpilot","type":"community_report","url":"https://www.trustpilot.com/review/shuffle.com"},{"credibility":1,"name":"Shuffle Casino License Page — Official","type":"official","url":"https://shuffle.com/info/license"},{"credibility":1,"name":"Is Shuffle Casino Licensed? Curacao License Explained — Shuffle Official Blog","type":"official","url":"https://shuffle.com/blog/is-shuffle-casino-licensed-curacao-license-explained"},{"credibility":2,"name":"Shuffle.com Licence Decoded: What OGL/2024/1337/0628 Means — PotsOfGold","type":"research","url":"https://potsofgold.com/shuffle-curacao-license/"},{"credibility":2,"name":"Noah Dummett — People in crypto — IQ.wiki","type":"other","url":"https://iq.wiki/wiki/noah-dummett"},{"credibility":2,"name":"Shuffle's Noah Dummett on his plan to outshine Stake — NEXT.io","type":"news_article","url":"https://next.io/news/features/shuffle-noah-dummett-plan-to-outshine-stake/"},{"credibility":2,"name":"Shuffle Casino Review 2026 — Bonus, Games, Payouts — CryptoSlate","type":"research","url":"https://cryptoslate.com/crypto-casinos/shuffle-casino-review/"}],"summary":"Shuffle (shuffle.com) is a crypto casino and sportsbook launched in February 2023, operated by Natural Nine B.V. under a Curacao Gaming Control Board license, and founded by Noah Dummett alongside co-founders Darcy Spangler and Harley Fresh. In October 2025, Shuffle confirmed a major data breach through third-party CRM provider Fast Track that exposed personal data and KYC documents for the majority of its users. In August 2026, blockchain investigator ZachXBT alleged that stolen victim funds were wagered on Shuffle in real time while the alleged thief was on the phone with the victim; Shuffle confirmed it would lock the associated account after reviewing submitted evidence.","timeline":[{"date":"2023-02-01","event":"Shuffle (shuffle.com) launches publicly as a crypto casino and sportsbook, operated by Natural Nine B.V. under Curacao licensing.","source":"CryptoSlate company profile","source_url":"https://cryptoslate.com/companies/shuffle/"},{"date":"2024-03-01","event":"Shuffle issues its native ERC-20 token, SHFL, to support VIP rewards and community airdrop programs.","source":"Shuffle review — PotsOfGold","source_url":"https://potsofgold.com/shuffle-curacao-license/"},{"date":"2025-10-10","event":"Shuffle confirms a data breach through third-party CRM provider Fast Track. The majority of users are affected; exposed data includes full names, addresses, transaction histories, and KYC documents (driver's licenses and passports). Passwords and funds reported as unaffected.","source":"Brave New Coin — Shuffle Data Breach","source_url":"https://bravenewcoin.com/insights/shuffle-data-breach-major-crypto-casino-hit-by-third-party-crm-attack"},{"date":"2025-10-10","event":"Shuffle announces it will terminate its partnership with Fast Track and advises users to enable two-factor authentication.","source":"BitcoinEthereumNews — Shuffle Data Breach","source_url":"https://bitcoinethereumnews.com/crypto/shuffle-data-breach-major-crypto-casino-hit-by-third-party-crm-attack/"},{"date":"2026-07-31","event":"At least one player complaint documents approximately $20,000 in withdrawals placed under compliance review at Shuffle with no resolution after completion of KYC steps.","source":"AskGamblers complaint — Shuffle withdrawal stuck under review","source_url":"https://www.askgamblers.com/casino-complaints/shuffle-casino-withdrawal-stuck-under-review-for-over-2-weeks"},{"date":"2026-08-10","event":"ZachXBT publishes an investigation on X alleging that Tiffany Milanovich, a US-based individual, allegedly wagered stolen victim funds on Shuffle in real time while on the phone with the victim. ZachXBT states he reported the account to Shuffle, and Shuffle confirmed it would lock the account after reviewing the evidence.","source":"ZachXBT on X — investigation thread","source_url":"https://x.com/zachxbt/status/2086785502750138684"},{"date":"2026-08-10","event":"Shuffle confirms to ZachXBT that it reviewed the submitted evidence and will lock the account associated with the alleged theft and gambling activity.","source":"CryptoTimes — ZachXBT Links U.S. Resident to Alleged $5M in Crypto Support Impersonation Thefts","source_url":"https://www.cryptotimes.io/2026/08/10/zachxbt-links-u-s-resident-to-alleged-5m-in-crypto-support-impersonation-thefts/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision db39a028-c544-4828-a795-96a081d1b2eecopy
2. #2reviewby reviewerreviewer

   2026-08-25 10:04:01Z
   Score: 38 → 38 (no score change)
   The large majority of the page's claims about Shuffle's corporate background, licensing, the October 2025 Fast Track data breach, and the August 2026 ZachXBT/Milanovich allegations are independently corroborated by multiple credible sources and, in several cases, directly quoted language in cited articles. The withdrawal-complaints section contains one clearly disputed claim, where the cited AskGamblers complaint's actual dollar amount (3,000 USDC + 14 SOL) and date (circa mid/late 2025) do not match the page's stated figures ($20,000, July 31, 2026); this undermines the evidentiary basis for that section's flagship example even though the broader withdrawal-complaint pattern is independently supported by other genuine complaints. Several negative existence claims about the absence of regulatory enforcement action were left as unverifiable rather than confirmed, since a clean record cannot be proven with certainty from available search coverage.
   anchoranchored

   chain

   ●mainnet-betaslot 443,513,180

   sig

   4rEEAD4AMuYy…4Xein9FCcopyexplorer ↗

   hash

   4jb7pGkmopYb…Sy8tWDFLcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1314 B) ▸

   {"actor":"reviewer","decided_at":"2026-08-25T10:04:01.009Z","decision":"review","investigation_id":"abe68948-0c6d-437a-9c8a-629b64c141cd","new_score":38,"page_slug":"shuffle-shuffle-com","prev_score":38,"reason":"The large majority of the page's claims about Shuffle's corporate background, licensing, the October 2025 Fast Track data breach, and the August 2026 ZachXBT/Milanovich allegations are independently corroborated by multiple credible sources and, in several cases, directly quoted language in cited articles. The withdrawal-complaints section contains one clearly disputed claim, where the cited AskGamblers complaint's actual dollar amount (3,000 USDC + 14 SOL) and date (circa mid/late 2025) do not match the page's stated figures ($20,000, July 31, 2026); this undermines the evidentiary basis for that section's flagship example even though the broader withdrawal-complaint pattern is independently supported by other genuine complaints. Several negative existence claims about the absence of regulatory enforcement action were left as unverifiable rather than confirmed, since a clean record cannot be proven with certainty from available search coverage.","score_delta":0,"sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision db581a75-ee76-418e-a9ae-93268f9ea11bcopy
3. #3review reviseby judgejudge

   2026-08-25 10:04:01Z
   Score: 38 → 26 (-12)
   The fact-check found 23 of 31 claims fully confirmed, including the entity's core identity, licensing (verified directly against the regulator's own record), the October 2025 data breach, and the ZachXBT/Milanovich account-lock allegation, which was quote-matched against its cited source. However, claim_findings[24] — the '~$20,000 withdrawal held since July 31, 2026' complaint used as the flagship example of the page's withdrawal-complaints section — does not match its own cited AskGamblers source, which describes a smaller withdrawal (3,000 USDC + 14 SOL) filed roughly a year earlier. Combined with a high-priority coverage gap calling for that section to be re-sourced, plus a second high-priority gap noting the ZachXBT theft allegations lack on-chain corroboration, this pushes the page into revise territory even though the overall disputed rate (12.9%) is low. Several minor imprecisions among partially-supported claims (an 'FTX employee' characterization, wager-timing, and Trustpilot review-count figures) further support a moderate correction rather than a clean pass.
   anchoranchored

   chain

   ●mainnet-betaslot 443,513,183

   sig

   2FbNKQwfiiiy…AjD5BwUAcopyexplorer ↗

   hash

   DxjRWXkof8xy…Y79Wi3wicopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1447 B) ▸

   {"actor":"judge","decided_at":"2026-08-25T10:04:01.009Z","decision":"review_revise","investigation_id":"abe68948-0c6d-437a-9c8a-629b64c141cd","new_score":26,"page_slug":"shuffle-shuffle-com","prev_score":38,"reason":"The fact-check found 23 of 31 claims fully confirmed, including the entity's core identity, licensing (verified directly against the regulator's own record), the October 2025 data breach, and the ZachXBT/Milanovich account-lock allegation, which was quote-matched against its cited source. However, claim_findings[24] — the '~$20,000 withdrawal held since July 31, 2026' complaint used as the flagship example of the page's withdrawal-complaints section — does not match its own cited AskGamblers source, which describes a smaller withdrawal (3,000 USDC + 14 SOL) filed roughly a year earlier. Combined with a high-priority coverage gap calling for that section to be re-sourced, plus a second high-priority gap noting the ZachXBT theft allegations lack on-chain corroboration, this pushes the page into revise territory even though the overall disputed rate (12.9%) is low. Several minor imprecisions among partially-supported claims (an 'FTX employee' characterization, wager-timing, and Trustpilot review-count figures) further support a moderate correction rather than a clean pass.","score_delta":-12,"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision eac34d3a-54be-40e1-bce3-04b2f62a8b0ccopy