Curaçao leak reveals the real owners behind Stake, 1xBet, Blaze

Lilith Wittmann didn’t just find a hole in the Curaçao Gaming Authority’s systems. She built a fake identity to get inside one, registering an account under the name of a known Dutch trust manager and using her own personal Gmail address to do it. Once the account cleared approval in late December 2025, she didn’t file a permit application at all. She uploaded software designed to take control of the licensing portal itself. What came out the other end was thousands of confidential documents covering roughly 800 unique owners across 646 licensed gambling companies, personal history statements, passports, tax filings, and financial records that Curaçao had collected and never made public.

That leak became the spine of Casino Secrets, an investigation run by Follow the Money alongside NRK in Norway, NDR in Germany, SVT in Sweden, and Jetzt.at in Austria. Reporters worked through the material with Wittmann’s consent and ended up verifying 897 beneficial ownership records tied to 767 distinct individuals, a scale that turns “who actually owns these platforms” from a running industry joke into a documented answer for the first time.

Stake’s licensing entity, Medium Rare NV, lists Serbian businessman Mladen Vuckovic as the sole beneficial owner, claiming a fortune above $1 billion. CGA’s own staff weren’t convinced that was the whole story. Internal notes flagged tens or hundreds of millions of dollars flowing to entities connected to Ed Craven and Bijan Tehrani, the two men publicly known as Stake’s founders but never mentioned anywhere in the actual licensing paperwork. Forensic accounting professor Marcel Pheijffer called approving the license under those conditions incomprehensible. Neither Vuckovic nor his trust representatives responded to the reporters.

1xBet’s Curaçao entity, Caecus NV, names Ukrainian national Ihor Hniedash as CEO and owner, reporting roughly €10 million in annual income. CGA staff suspected multiple owners here too and asked Hniedash directly about his relationship to Roman Semiokhin, Dmitry Kazorin, and the late Sergey Karshkov, the trio publicly associated with founding 1xBet, one of whom died in 2023. The license went through anyway. Capital Trust Corporation, the firm handling the application, declined to comment on what assumptions it had made about its client.

Novatech Solutions NV, the entity behind Qbet and 55Bet, lists 42-year-old Filipino national Joanna Tinaco Arenas as ultimate beneficial owner, with a declared $1.5 million in crypto and real estate whose origin the paperwork never explains. Investigators suspect Qbet functions as more of a house brand for the Manila-based company Arenas actually works for than an operation she independently owns. Separately, the Dutch Gaming Authority hit the brand with a €24.9 million fine in 2025, and the Dutch state lottery filed suit in April trying to hold both the operator and its trustees liable.

Blaze’s licensing vehicle, Prolific Trade NV, names two owners: Dutch national Nick van Gorsel, born in 1996 in Bergen op Zoom, claiming €800 million, and American Nicholas Beugg, also born in 1996, claiming €500 million. Blaze has already faced lawsuits in Brazil over unpaid winnings and refused to engage with reporters on the ownership question; trustee Stefanie Knoester cited confidentiality rules and declined to answer anything.

The leak connects to two more cases with less documentation behind them in what’s public so far. Platincasino, described as Germany’s largest illegal operator, traces back through Malta and Curaçao registrations to a company once run by Thomas Kalman, alongside an alleged tax gap of roughly €250 million tied to the brand’s history. CasinoFriday’s Curaçao entity is reported elsewhere to list a Norwegian owner, though independent detail on that specific claim is thinner than on the other cases here and worth treating as less settled until more reporting lands.

CGA’s own defense is that it was running a deliberate transition period, letting companies meet requirements gradually instead of rejecting applications outright over unclear ownership. Pheijffer’s response to that framing was blunt: regulators are supposed to think first and act second, not the other way around. Offshore finance expert Jan van Koningsveld added that uncertainty alone doesn’t have to block a license, but a sector this exposed to money laundering risk should come with real ongoing supervision, not a one-time approval and silence afterward. Attorney Roel Bijkerk put the business logic more plainly: a Curaçao license mostly functions as an excuse payment processors and game providers can point to when they decide to work with an otherwise unlicensed operator.

The breach itself is the same incident CGA disclosed on September 17, when it said the intrusion had been contained and its source identified while the full scope was still under review. Wittmann had already shown this pattern was repeatable. In March 2026, she got into Malta’s own regulator, the MGA, using a similar approach.