Shuffle / Shuffle.us MAJOR SECURITY FAILURE = my $10K deposit withheld

[rohang]

Black29 is a confirmed scammer.

You can read here: https://casino.guru/complaints/shuffle-us-casino-player-s-account-has-been-closed

fyi: that link doesnt open for me and leads to the all complaints page.
Maybe its deleted/ off limits

[black29]

Black29 is a confirmed scammer.

You can read here: https://casino.guru/complaints/shuffle-us-casino-player-s-account-has-been-closed

Do your job Tim and think twice before throwing false accusations around.  I couldn't have been more anti scam if I tried.  Shuffle dropped the ball here and failed to protect it's players. If you guys would show a little more respect and learn how to communicate I bet 70% of your complaints would be resolved. If you guys would have just put a little effort into this and actually listened to what I was saying, you probably could have caught this guy.  But instead you want to act like an arrogant assh**le and then blame me and call me a scammer...? wtf man. I am fkn telling you I had nothing to do with this sht /scam, exploit / game manipulation bullsht.  

[black29]

============================================================
JULY 14, 2026 - CONVERSATION STARTED 11:44 PM UTC
============================================================
11:44 PM | [REDACTED]: Account Query
11:44 PM | [REDACTED]: Other Queries
11:44 PM | Shuffle.us Bot: Please let us know what your query is.
You're able to escalate to a human for live support if you wish to do so.
11:44 PM | [REDACTED]: my acct was compromised
11:44 PM | Shuffle.us Bot: Sorry you're dealing with that, [REDACTED]. If your account was compromised, the next step is
to start an account recovery by emailing support@shuffle.us from the email address you want linked to your account (or
from the email currently linked, if you still have access). Include any details they may ask for, and allow up to 24 hours
for the first reply.
11:44 PM | Shuffle.us Bot: Is that what you were looking for?
Exported from Shuffle.us on July 17, 2026 at 05:19 PM UTC.
============================================================
JULY 16, 2026 - CONVERSATION STARTED 04:00 PM UTC
============================================================
04:00 PM | [REDACTED]: Account Query
04:00 PM | [REDACTED]: Other Queries
04:00 PM | Shuffle.us Bot: Please let us know what your query is.
You're able to escalate to a human for live support if you wish to do so.
04:00 PM | [REDACTED]: my acct has been compromised and someone has changed my 2fa.
04:00 PM | [REDACTED]: they have control of me email too
04:01 PM | Shuffle.us Bot: That's a tough situation - sorry you're dealing with that.
Since both your 2FA and email are compromised, the next step is to start the account recovery process:
- Email support@shuffle.us from a new email address you want to use going forward.
- Explain that your account was compromised and your 2FA was changed.
- Be ready to provide any account details they may ask for to verify ownership.
04:01 PM | [REDACTED]: I can verify my identity via ID and live check or whatever needed
04:01 PM | [REDACTED]: please put a temp hold on my acct
04:01 PM | Sofia from Shuffle.us: Hi there, please explain what you mean by you knew this was going to happen?
04:02 PM | [REDACTED]: the other day I noticed weird activity on my laptop
04:02 PM | [REDACTED]: I messaged you guys as soon as I noticed it
04:03 PM | [REDACTED]: [Image]
04:06 PM | Fred from Shuffle.us: Sorry you're dealing with that, [REDACTED]. If your account was compromised, the next
step is to start an account recovery by emailing support@shuffle.us from the email address you want linked to your account
(or from the email currently linked, if you still have access). Include any details they may ask for, and allow up to 24
hours for the first reply.
If you also use 2FA and can't access your codes, email support@shuffle.us from the email linked to your account to start
2FA recovery.
04:06 PM | [REDACTED]: I dont have 2fa
04:06 PM | [REDACTED]: they changed it
04:06 PM | [REDACTED]: please pause redemptions
04:08 PM | [REDACTED]: what do I do now?
04:08 PM | [REDACTED]: how can I secure my acct?
04:09 PM | [REDACTED]: I sent an email but its from a different acct bc my acct associated with shuffle.us has also been
compromised.
04:11 PM | [REDACTED]: when I first was concerned about my sht being hacked, I emailed support from my email. hours went
by with no response from you guys and I started to think I was just paranoid or being stupid so I stopped being concerned
about it. I can see now that I wasn't crazy
04:12 PM | Sofia from Shuffle.us: Which email have you contacted us from?
04:49 PM | [REDACTED]: sent pic n ID
04:52 PM | [REDACTED]: just verified my address now too
05:03 PM | [REDACTED]: is there anything else I can do to be proactive with this?
============================================================
JULY 16, 2026 - CONVERSATION STARTED 05:58 PM UTC
============================================================
05:58 PM | [REDACTED]: Live Support
05:59 PM | Shuffle.us Bot: Your access to live support is currently revoked.
Please contact support@shuffle.us for any enquiries
Exported from Shuffle.us on July 17, 2026 at 05:19 PM UTC.
============================================================
FOLLOWING-DAY EXCHANGE SHOWN IN SCREENSHOT 08
============================================================
[REDACTED]: can you please respond to my emails or allow me to communicate via live support? I need your guys help with my
account
Shuffle.us Bot: We are not able to serve you via live support at this time.
Please contact us via email at support@shuffle.us with your query.
Thank you.

[AHOYBRAUSE]

Black29 is a confirmed scammer.

You can read here: https://casino.guru/complaints/shuffle-us-casino-player-s-account-has-been-closed

Yeah if you throw an accusation like this into the room you should at least double check the link you are posting. Tried to open (doesn't exist) and searching through the database also doesn't bring any result unfortunately.

Wer have 3 pages in this thread now and not really one reply that would to anything. Better take this a bit more serious because replying like this is definitely not a good look.

[Slow death]

I've been seeing this thread for a few weeks and I always forget to comment on it, maybe because I'm lazy since you don't provide complete information. For example, someone even helped you by telling you to use the appropriate format, and even with the correct format you couldn't post complete information. Let's go step by step:

- What day did you make the $10,000 deposit and where is the TXID for that deposit (link and not what you posted)?

- What game did you play right after you made the $10,000 deposit?

- After you won $44,000, how many hours or days did it take for you to lose your 2Fa?

- Why didn't you withdraw everything you won as soon as you won $44.000?

- And why didn't you answer Casino Guru?

This was the statement from casino.guru:

The player from Ohio initiated a redemption of approximately $44,000 but faced delays due to identity verification requests. After submitting the necessary documents, communication from Shuffle ceased, and the player was concerned about their crypto wallet security, seeking to cancel the redemption and update the payout wallet. They requested a review of their KYC, clear communication regarding their account status, and assurance that the redemption would not be sent to a potentially compromised wallet. We asked for details about the documents provided and extended the timer, but no reply was received from the player. As a result, the complaint was closed for now because we could not proceed without further communication.

source: https://casino.guru/complaints/shuffle-casino-player-s-withdrawal-is-delayed-and-13

You didn't answer them and you didn't mention 2FA on casino.guro, but you did talk about a wallet with the potential to be compromised. This means you're giving information little by little. You had a good opportunity to provide everything casino.guro asked for and you disappeared without saying anything.

[AHOYBRAUSE]

snip

Valid questions and nice find! I mean when you open an accusation at a 3rd party mediator it's common sense to follow up on it once being asked questions by the people that are actually trying to help. I mean in here OP is not so shy to reply, but there he didn't for whatever reason.
So yeah, many question marks are circulating over this thread. First he gets accused of being a scammer himself, then the questionable handling of the casinoguru complaint. What happened there OP?

[holydarkness]

So this just got a lot messier... shuffle is adamant that there was some serious misconduct associated with my account.  As strongly they feel that I did something wrong, I feel that I didn't.  I know I didn't.  Then I remembered there was an issue with my account right before all this sht went down. I'll add in the details here shortly.


@holydarkness If it's cool with you, I'm going to send this to you via PM first to screen? I want to ensure I'm not exposing any sensitive data before posting it here.

I guess you've beat me out of my reply by posting it, with redaction? That copy-paste text of chatlog? I assume that is what you want to show me? Well, if it it, then you no longer need to PM me as you've managed to get around it.

Now, did you or did you not reply to your own case on CG?

[bone777]

Check out the chat log from July 16. A guy asked tech support to stop a payout and enable a temporary freeze due to a 2FA hack. But support told him to email them and wait 24 hours. This is a huge mistake on the part of support. They should have immediately frozen withdrawals if a player reports a hack. If tech support ignored this message from the player and allowed the hacker to empty the wallet, then the casino is liable for this loss.

[Shuffle_Tim]

Black29 is a confirmed scammer.

You can read here: https://casino.guru/complaints/shuffle-us-casino-player-s-account-has-been-closed

fyi: that link doesnt open for me and leads to the all complaints page.
Maybe its deleted/ off limits

Yep, Casinoguru a bit funny with geo access. I believe as this is Shuffle.US they restricted to USA access only.

Here are the responses.

https://talkimg.com/images/2026/09/05/UevzEq.png
https://talkimg.com/images/2026/09/05/UevF5j.png

[black29]

I've been seeing this thread for a few weeks and I always forget to comment on it, maybe because I'm lazy since you don't provide complete information. For example, someone even helped you by telling you to use the appropriate format, and even with the correct format you couldn't post complete information. Let's go step by step:

- What day did you make the $10,000 deposit and where is the TXID for that deposit (link and not what you posted)?

- What game did you play right after you made the $10,000 deposit?

- After you won $44,000, how many hours or days did it take for you to lose your 2Fa?

- Why didn't you withdraw everything you won as soon as you won $44.000?

- And why didn't you answer Casino Guru?

This was the statement from casino.guru:

The player from Ohio initiated a redemption of approximately $44,000 but faced delays due to identity verification requests. After submitting the necessary documents, communication from Shuffle ceased, and the player was concerned about their crypto wallet security, seeking to cancel the redemption and update the payout wallet. They requested a review of their KYC, clear communication regarding their account status, and assurance that the redemption would not be sent to a potentially compromised wallet. We asked for details about the documents provided and extended the timer, but no reply was received from the player. As a result, the complaint was closed for now because we could not proceed without further communication.

source: https://casino.guru/complaints/shuffle-casino-player-s-withdrawal-is-delayed-and-13

You didn't answer them and you didn't mention 2FA on casino.guro, but you did talk about a wallet with the potential to be compromised. This means you're giving information little by little. You had a good opportunity to provide everything casino.guro asked for and you disappeared without saying anything.

There ended up being 2 dispute claims because 1 of them had an error in the title complaint and it said $440,000 instead of $44,000. I responded to the $44,000 one.

[black29]

So this just got a lot messier... shuffle is adamant that there was some serious misconduct associated with my account.  As strongly they feel that I did something wrong, I feel that I didn't.  I know I didn't.  Then I remembered there was an issue with my account right before all this sht went down. I'll add in the details here shortly.


@holydarkness If it's cool with you, I'm going to send this to you via PM first to screen? I want to ensure I'm not exposing any sensitive data before posting it here.

I guess you've beat me out of my reply by posting it, with redaction? That copy-paste text of chatlog? I assume that is what you want to show me? Well, if it it, then you no longer need to PM me as you've managed to get around it.

Now, did you or did you not reply to your own case on CG?

No, I got a message saying that my post with that question was deleted.  I didn't really understand and was apprehensive about messaging you because I didn't know if I had done something wrong.  I have screenshots of the conversations with shuffle support as well as the unknown session stuff and other info like the IP that wasn't mine and things like that

[black29]

Check out the chat log from July 16. A guy asked tech support to stop a payout and enable a temporary freeze due to a 2FA hack. But support told him to email them and wait 24 hours. This is a huge mistake on the part of support. They should have immediately frozen withdrawals if a player reports a hack. If tech support ignored this message from the player and allowed the hacker to empty the wallet, then the casino is liable for this loss.

They didn't care and they don't care. This was a complete security failure from Shuffle.

[black29]

Black29 is a confirmed scammer.

You can read here: https://casino.guru/complaints/shuffle-us-casino-player-s-account-has-been-closed

fyi: that link doesnt open for me and leads to the all complaints page.
Maybe its deleted/ off limits

Yep, Casinoguru a bit funny with geo access. I believe as this is Shuffle.US they restricted to USA access only.

Here are the responses.

https://talkimg.com/images/2026/09/05/UevzEq.png
https://talkimg.com/images/2026/09/05/UevF5j.png

And yet you have no response to my reply with this major security issue and I believe you owe me an apology Shuffle Tim

[black29]

Black29 is a confirmed scammer.

You can read here: https://casino.guru/complaints/shuffle-us-casino-player-s-account-has-been-closed

ANSWER THESE QUESTIONS TIM:

Questions Shuffle should answer

1. Which session ID, IP address, operating system, browser, device fingerprint, and client information issued the requests connected to wagers [icode]Cd53DS49[/icode] and [icode]Cd53W2me[/icode]?

2. When was the account’s two factor authentication changed or reset, and from which IP address and device?

3. Did Shuffle compare the disputed requests with the unfamiliar Windows and Firefox session at [icode]146.70.187.252[/icode]?

4. Did Shuffle investigate my July 14 compromise report before attributing the July 16 activity to me?

5. What protection did Shuffle place on the account after being told it was compromised?

6. Why was my access to live support revoked after I completed the requested identity verification and repeatedly asked Shuffle to protect the account and pause redemptions?

7. What evidence establishes that I personally issued the backend requests, rather than someone controlling a compromised authenticated session?


I am asking Shuffle to disclose the session attribution evidence supporting its accusation and to conduct a genuine review that accounts for the compromise report submitted before the disputed activity.

Until Shuffle answers these questions, treating an authenticated session as conclusive proof of the account owner’s identity is neither technically sound nor a sufficient basis for withholding approximately $44,000.

[AHOYBRAUSE]

There ended up being 2 dispute claims because 1 of them had an error in the title complaint and it said $440,000 instead of $44,000. I responded to the $44,000 one.

So why don't you share the other casinoguru thread here to give some more insight? Also, you should putt all those responses in one big reply. The way you do it is actually against forum rules, you are not allowed to make back to back to back to back .... replies/posts in the same thread and day without anybody replying in between. Just for your information.

[logfiles]

Black29 is a confirmed scammer.

You can read here: https://casino.guru/complaints/shuffle-us-casino-player-s-account-has-been-closed

fyi: that link doesnt open for me and leads to the all complaints page.
Maybe its deleted/ off limits

Us a VPN and select any of the US locations and you will be able to see the complaint otherwise you might think the page does not exist. I was able to red the judgement by the casinoguru team and I have no reason to doubt their findings.

<...>

You should have asked this questions in the now closed dispute thread. Doing it here is not going to help.

[black29]

I apologize if I am not following scam accusations format and after this response I will try to go thru the rules and reformat if possible.


There are a few things I'd like to address

1.

• I did NOT manipulate or exploit any game on shuffle's slots!
• I understand that shuffle claims a session associated with my account did something that attempted to do something to manipulate an outcome of a game. Or similar that cites violation of shuffle terms.
• I believe BOTH to can be true at the same time
• My account was almost a year old, verified, and has had several deposits and withdrawals.

2.

My account was compromised shortly before this incident occurred. I thought this because of google alerts regarding account security. I followed the prompts to secure account and changed password.

3.

I immediately told shuffle live support that I believed my account had been compromised. They responded with a generic bot message telling me to change password and 2fa and that it would be 24 hours before I would get an email response from support. My 2fa was email. I changed password. A few times I think.

4.

I deposited $10K, ended up with a $4k balance and a $44k withdrawal pending. I noticed my 2fa had been changed and tried to disable it. I alerted shuffle live support to get 2fa changed. I couldn't log into my email and told shuffle I couldn't disable 2fa and account must had been compromised.

• I told shuffle to PAUSE any redemptions and made them aware of security issue and made it clear that no money should be sent to the address I had previously requested because I was unsure of it had been compromised as well. I emailed shuffle from another email and was compliant with all kyc requests.
• I was able to recover my original email address and secured account. I changed password, added new sign in methods such as passkey, and added 2fa. I was made aware of unknown devices that had logged into my google account and was able to remove them. I was assured that email and google account were secured.
• I emailed shuffle and went on to shuffle live support to make them aware I had access to my email again.
• I was banned from live support and my account was put into "withdrawal only mode"
• I was unable to change my 2fa nor was I able to kyc level 3. It would accept all info and docs but not approve verification,
• After submitting all kyc docs (level 2) Shuffle stopped responding to any emails. I was left with no information, no understanding of situation, and no way of being able to communicate with shuffle. This went on for almost 2 weeks.
• I combed my account trying to find anything that could help me understand what was going on and I found that there were unknown sessions active on my account that were not from me. I realized that I never received any notifications from shuffle alerting me of deposits, redemptions, or any other important alerts from shuffle.
• My account was suspended. Still no communication with shuffle. So I posted on Casino Guru and Bitcointalk
• Almost 2 weeks later I received an email from shuffle stating my account had been closed, my balance, deposits, and winnings were confiscated and they cited violations of vague terms regarding exploiting 3rd party games.
• I proceeded with putting social pressure on the via Casino Guru, Bitcointalk, and Ask Gamblers.
  
  Casino Guru proceeded with taking on mediation and investigating complaint. Ask Gamblers said this was out of their scope. And Bitcointalk started gaining momentum with discussions. Shuffle did not respond to direct emails nor any forums. They completely ignored me and left me without any evidence nor explanation of why they were not paying me.
• I felt I was entitled to at least get my deposit of $10k back and sent them emails demanding that they pay me or provide proof that I violated their terms and I gave them a safe, secured Solana address to send to.
• They never replied to any of me emails. I moved forward with sending complaints to the Attorney General, BBB, FTC, and following up other threads.
• Shuffle finally responded to Casino Guru and sent them evidence of 3rd Party Game manipulation and Casino Guru sided with them, closed case, and marked as rejected.
• I didn't get to explain account security issues to Casino Guru to get their input so I attempted to reopen the case and am awaiting their response.

                HEY SHUFFLE TIM can you help address these concerns!?

                          Or just blatantly ignore ?

[holydarkness]

There ended up being 2 dispute claims because 1 of them had an error in the title complaint and it said $440,000 instead of $44,000. I responded to the $44,000 one.

Can you please kindly link us to the 44,000 one, then? Because I tried to locate it and found that you only have one complaint lodged to CG, the one amounted 440,000. The 44,000 is non-existent.

[black29]

https://casino.guru/forum/complaints-discussion/shuffle-us-closed-my-account-and-withheld-usd48-000-after-a-usd10-000-deposit?utm_medium=email&utm_source=system&utm_campaign=forum&utm_term=11-09-2026#post-288548

[black29]

Shuffle.US security failure: $10K deposit withheld

Updated September 14, 2026

I have revised this opening post to consolidate the dispute and explain the significance of my security report before the disputed gameplay. My full account funds remain disputed. The $10,000 referenced in the title is my original deposit, which I am requesting back at minimum; it is not the total amount withheld.

My earlier post is preserved at the bottom for transparency and context. It contains earlier reported amounts and status updates and should be read as a historical record.


What happened

Shuffle.US permanently closed my account on July 28, 2026, and withheld my funds, including approximately $10,000 of my own deposited money. Shuffle alleges game exploitation. I deny manipulating games, generating backend requests, or creating, controlling, or using any other Shuffle.US accounts.

The central issue is that I reported my account compromised before the disputed gameplay occurred.

On July 14, 2026, at 11:44 PM UTC, I contacted Shuffle support to report the compromise. The disputed gameplay occurred on July 16. My linked Google account had security alerts indicating unfamiliar access. Shortly afterward, my Shuffle 2FA settings and password were changed without my authorization. I later found Shuffle’s session records showing an unfamiliar Windows/Firefox session. I use a MacBook or iPhone, primarily through Safari.

Section 4.9 of Shuffle’s terms requires users to immediately report suspected account compromise. That is what I did. Despite that report, Shuffle’s automated support directed me toward account recovery with an email response expected within 24 hours.

Why was the account allowed to remain active after I reported it compromised? What action, if any, did Shuffle take to secure it?

I also requested that pending withdrawals be paused so funds would not be sent to compromised addresses. Shuffle subsequently requested additional KYC documentation, which I provided. My account was later closed, and my funds were withheld.

What Shuffle alleges

Shuffle says its provider identified abnormal gameplay involving specially generated backend requests through an authenticated session. It also refers to similar activity on other “linked” accounts.

An authenticated session identifies account access. It does not, by itself, establish who generated or authorized the activity, particularly when unauthorized access had already been reported. That is why the unfamiliar Windows/Firefox session matters.

Sections 4.10 through 4.11.2 broadly assign responsibility for unauthorized account use to the account holder. But Section 4.11.4 expressly includes an exception to Shuffle’s liability disclaimer when the user previously reported that their account information was no longer secure. How did Shuffle apply that exception to my July 14 warning?

Shuffle.US Terms and Conditions

I believe Shuffle’s response to my security report failed to address the ongoing risk. Securing the account and terminating unauthorized sessions could have prevented further unauthorized activity. Instead, I faced additional verification requests and ultimately lost access to my account and funds.

I have asked whether the flagged requests and linked accounts correspond to my recognized devices and normal activity or to the unfamiliar session I identified. I have not received a clear answer to that distinction.

I am not asking Shuffle to publish proprietary fraud detection methods. I am asking for a substantive explanation of how it addressed my security warning, applied its prior notification exception, and determined that I was responsible for activity that occurred afterward.

My $10,000 deposit remains withheld

The disputed funds include 139.99 SOL deposited by me, worth approximately $10,000 at the time. No bonus money was used.

Even if Shuffle disputes the winnings, it should separately explain its basis for retaining my original deposit. An allegation concerning subsequent gameplay does not answer that question, particularly when I had already reported the account compromised.

Resolution requested

I continue to dispute the withholding of my full account funds. At minimum, I am requesting:

• Return of my approximately $10,000 original deposit.
• An explanation of what action Shuffle took after my July 14 compromise report and how it applied Section 4.11.4.
• A substantive response addressing whether the alleged activity was attributable to me or to unauthorized access through my account.

Casino: Shuffle.US
Terms: Terms and Conditions
Principal deposit sought: Approximately $10,000 USD
Payment method: Solana (SOL)
Deposit amount: 139.99 SOL
Payment evidence: On-chain transaction record and supporting account communications available.

Shuffle can contact me directly to resolve this dispute and arrange repayment.

[/quote]


Why do terms only seem to matter when they're being used against a player and not used to protect them?