To win big in poker, you need skill, luck — and it doesn’t hurt if you somehow know the cards in every other player’s hand. I’m a terrible poker player, but I teamed up with a casino cheating expert and a hacker who uncovered a high-tech way to digitally rig one of the most common card shuffling machines used in casinos across the United States. Together, we designed a scheme to hack that machine — and try to win big in Las Vegas.
I’m Andy Greenberg, and I investigate the strange, dark, and subversive sides of technology for Wired. This is Hack Lab: I Cheated at Poker by Hacking a Casino Card Shuffling Machine.
This experiment takes me to Las Vegas, Nevada, for DEF CON, America’s biggest hacker conference. There, I meet Joseph Tartaro, a researcher and consultant with the security firm IOActive.
Two years ago, I wrote a story for Wired about Joseph’s technique for hacking card shufflers to take full control of a poker game — enabling perfect, undetectable cheating in a live casino environment. Today, I’ll put his method to the test by trying to cheat unsuspecting players in a real game of Texas Hold’em. But first, I need to understand how the shuffler works.
How the Deckmate 2 Works — and How It Can Be Hacked
The device in question is the Deckmate 2, the most widely used automatic card shuffler in major poker rooms — even at the World Series of Poker. It sits flush under the table, right next to the dealer’s knees.
Internally, the Deckmate doesn’t shuffle cards the way a human would with a riffle shuffle. Instead, it uses 20 to 26 shelves and a random number generator. It places cards into different positions — say, the first card into position three, the next into position twelve — until the full deck is produced. Its main purpose is to increase the number of hands dealt per hour.
But the Deckmate has another, more powerful feature: it can completely sort a deck in perfect order — ace to king, suit by suit. That’s a built-in capability. And if a shuffler can order the deck in sequence, then a hacker can reorder it however they like, controlling the placement of every single card.
Joseph demonstrated this with a fun example: he hacked the Deckmate so that it would deal the exact same hands from the iconic poker scene in Casino Royale. In that movie, the villain makes a full house — and James Bond wins with a straight flush. Joseph reproduced that scenario perfectly, simply by altering the machine’s code.
If a player cuts the deck after shuffling, it ruins the perfect order you’ve created. Joseph anticipated that. He showed me a mathematically “solved deck” — one ordered so that no matter where the deck is cut, the player in a specific seat (in this case, the dealer button) will always win.
A computer program can calculate a deck order that guarantees this outcome. It’s counterintuitive, but mathematicians have proven it’s possible. As long as you know where your target player will be seated, you can ensure they always win — even if the deck is cut.
We tested it, and it worked. No matter how I cut the deck, I ended up with the best hand — in this case, two pair (queens and nines) — and beat Joseph.
Using the Shuffler’s Camera Against It
Inside every Deckmate 2 is a built-in camera, designed as a security feature. Its purpose is to detect tampering — for example, if someone removes the ace of spades and sneaks in an extra seven of diamonds, the system will flag it.
Here's our strategy. Using the shuffler's built-in camera, we'll access it, learn the deck's layout, and send it via Bluetooth to an app on our phone. After all, the best way to win discreetly is to know when you'll have the strongest hand at showdown.
But that camera can also be weaponized. By hacking into the shuffler and accessing its camera feed, Joseph showed how it’s possible to read the exact order of the deck. That information can then be transmitted via Bluetooth to a phone app.
This subtle method changes the entire cheating strategy. Instead of trying to rig the deck so you always have the best hand — which raises suspicion — you can simply know the order of the cards and play perfectly based on information. You don’t need to win every hand. You just need to know when you will and won’t win, so you can bet aggressively or fold early.
And that is the most powerful way to cheat in poker: not by forcing the best cards into your hand, but by knowing exactly what’s coming.
The Scandal That Sparked a Shuffler Hack
Joseph’s journey into shuffler hacking began with a single suspicious poker hand that set the poker world ablaze.
In September 2022, a scandal erupted during a live-streamed cash game on Hustler Casino Live in Los Angeles. In a now-infamous hand, a relative novice called a bluff holding nothing but jack of clubs and four of hearts, beating a seasoned professional.
The poker community exploded. No rational player could possibly believe that hand was strong enough to call a bluff — unless they had extra knowledge that their opponent’s hand was even worse. Accusations of cheating spread like wildfire. The player at the center of the controversy denied any wrongdoing, and Hustler Casino launched a formal investigation. Its conclusion: no evidence of foul play.
But one small detail in that report caught Joseph’s attention.
“It specifically said the shuffler could not be compromised,” Joseph recalled. “In my world, when people start saying something is unhackable or very difficult to do, that’s just bait to prove them wrong.”
Breaking the “Unhackable” Deckmate 2
Intrigued, Joseph and a few colleagues set out to reverse-engineer the Deckmate 2. They bought a secondhand unit and spent months dissecting how it worked. Their research focused on one key protection: firmware integrity checks.
On startup, the shuffler computes a hash — a mathematical fingerprint — of its firmware and compares it to the known value of the original code. If the hashes match, the machine assumes nothing has been tampered with. If they don’t, it refuses to run.
JJoseph’s breakthrough was simple but devastating: he and his team discovered they could alter the hash itself. By changing the stored hash to match the new, tampered code, the machine would boot normally — none the wiser that it had been compromised.
But to install their malicious code, a cheater would still need physical access to the machine. And Joseph found a way: the USB port.
The Deckmate 2’s USB port is often left exposed beneath the table — a small but critical oversight. And that was all Joseph needed.
The device in question is a miniature computer. Once connected, it rewrites the shuffler’s firmware and establishes a Bluetooth connection with a nearby smartphone. It’s small enough to be hidden inside the machine if someone has pre-game access. And in a busy poker room — with players switching seats, dropping chips, or leaning under the table — reaching down to “plug something in” would barely raise suspicion.
Once plugged in, the device does its work. It connects to the Deckmate’s internal camera, which scans and verifies each card during the shuffle. Every time the deck is shuffled, the hacked shuffler sends the exact order of the deck to the phone via Bluetooth.
But wouldn’t cutting the deck ruin this advantage? Joseph’s team built a workaround for that too.
The cheating app allows the user (or their accomplice) to enter just the two hole cards they’re dealt. With that information alone, the app can reverse-engineer the dealer’s cut position and reconstruct the order of the remaining cards. That means the cheater knows every hand at the table before they’re even dealt.
Because phone use is often restricted during live games, the team tested a more discreet version of the scheme: Joseph would look at his cards, fold, and then pick up his phone. Once out of the hand, he could legally use the app and signal betting advice to me based on which players would win.
The Manufacturer Responds — But Questions Remain
When Joseph and his team first presented this vulnerability two years ago, Andy reached out to the manufacturer, Shuffle Master, a subsidiary of Light & Wonder. At the time, the company dismissed the research as unrealistic, claiming such an attack wouldn’t work in a real casino environment. They declined to comment on whether they planned to fix the security flaw.
As we prepared to test the hack in a live game, I reached out again to see if anything had changed. This time, a spokesperson for Light & Wonder told me that they had patched the security flaws in virtually all Deckmate 2 units currently in use by updating the firmware.
Joseph wasn’t convinced.
“They’d need a technician to physically apply that firmware update,” he explained. “Maybe that’s happened. Maybe they just disabled the USB port. But in reality, we could use the Ethernet port instead. There are a number of ways to pull this off. And even if they patch it, they still can’t fix the fact that once someone has access to the internals, it’s game over.”
To get another perspective on all this, I spoke with Doug Polk, a professional poker player, YouTuber, and co-owner of The Lodge Card Club in Austin, Texas.
“These shuffle machines — I’ve seen them everywhere,” Polk said. “From the biggest, most established casinos all the way down to people’s home games.”
So, does Doug trust the Deckmate 2?
“In a regulated casino environment, you shouldn’t be too scared of it,” he said. “Casinos have contracts and licensed technicians maintaining them. The real problem is once a Deckmate 2 ends up on the black market or secondary market. Then it’s no longer maintained by the company. It’s just some guy in the back fixing it and putting it on the table.”
Doug says he’s heard “so many cheating stories” involving secondhand Deckmate 2 machines used in unregulated games. In fact, he’s even heard of issues arising in major casinos themselves.
“If there’s a camera in the machine that knows the cards,” he warned, “there’s always an underlying threat. Customers are essentially at the mercy of whoever set the machine up.”
What should a player do if they show up to a private game or an unlicensed cardroom and see a Deckmate 2 in use?
“If you walk into a private game and there’s a shuffler,” Polk said bluntly, “run for the hills.”
Learning to Cheat Like a Pro
We weren’t allowed to test our hack in a real casino, so we headed off the Strip to a dealer training school in Las Vegas. There, we set up a private poker game in a casino-like environment against real players — none of whom knew the odds were about to be stacked against them.
Before attempting the experiment, I needed a crash course in how professional cheaters operate. So I turned to Sal Piacente, a veteran security consultant who advises casinos on cheating prevention.
“How are people cheating in real casinos?” I asked.
“It depends on the game,” Sal explained. “In craps, people switch dice or slide them. In baccarat, you might see false shuffles where the dealer keeps track of certain cards. And in poker, there are many ways.”
Have there been cases of people rigging Deckmate 2 machines?
“It’s happening a lot in private games,” Sal said. “I’ve never heard of it being done in a casino.”
What about poker clubs in states like Texas, where you can play poker but there's no regulation as strict as in Nevada casinos?
“Anything goes,” he laughed. “If there’s money involved, believe me — someone’s staying up late to figure out how to steal it.”
Compromising the shuffler is only half the battle. The other half is communication — coordinating with a partner without getting caught. And according to Sal, signaling is “the number one scam in poker rooms worldwide,” happening every day undetected.
There are many ways to send covert signals. One old-school gadget is known as a thumper — a small device worn on the body. A wire runs down the cheater’s pant leg and into their shoe, with a pressure pad under their big toe.
“When I want to give you a signal, I press down,” Sal explained. “That sends a vibration to your hand.”
But today’s signaling methods can be far more sophisticated. Sal showed me a tiny inductive earpiece that sits next to the eardrum and is nearly invisible. It’s connected via a concealed loop under the clothing and plugs discreetly into a smartphone.
“When my partner talks to me,” he said, “it’s like hearing a third voice in my head.”
Building the Signaling System — and Setting Up the Cheat
The idea of having a hidden voice in my ear was tempting, but I wasn’t sure it would work in our particular setup. I needed a partner at the table who could see their own cards, enter a couple of them into the hacked app, and then silently signal me on how to act.
So I explained our entire plan to Sal Piacente.
“Okay, we’re actually going to do this,” I told him. “We’re going to set up a game with unsuspecting players, hack the Deckmate 2, and we’d love your advice on how to pull this off without getting caught.”
“I’m definitely interested in being involved,” Sal said.
Joseph explained that his custom app would receive the exact deck order from the hacked shuffler. The challenge was figuring out how to signal me — a self-described terrible poker player — on what to do during each hand.
The scheme worked from the very beginning. In one of the first hands, Joseph folded, looked at his phone, and started fiddling with three chips in his hand—a signal to raise.
Ellie called the flop and turn and gave up on the river, which I made a straight on.
Even though losing was impossible, I was incredibly nervous. In one hand, I misjudged Joseph's chip count and folded a hand I should have called with. And then I stopped getting winning cards.
More than an hour of the planned three hours had passed, and I kept folding and folding. I had a hacker on my side, but not luck. Fernando played excellently during this stretch and won a significant portion of the chips. Then Joseph forgot to signal with his left hand, and I couldn't see his right hand. I had to remind him quite clearly: "Joseph, are you by any chance left-handed?"
Will the other players or Sal notice our cheating? Or will the experiment end with me losing, even knowing everyone else's cards?
Finally, Joseph gave me the right signal, and I doubled up for the first time against Fernando, who barreled me with 10-high. He smiled when he saw my hand and commented on the hand, suggesting that I'd apparently decided not to fold A-high from the start.
Soon Ellie tried to bluff me with big bets, but following Joseph's advice, I paid on the four hit and took all of Ellie's chips.
After a while, Joseph again signaled me to be active.
I made big bets on the flop, turn, and, after making a straight, on the river.
Fernando called with top pair.
I bluffed the whole way and got there – nothing suspicious!
Fernando soon lost his last chips after going all-in on the flop. With against mine A perfectly logical call, and the pair of fives, as expected, held.
After that, we returned Ellie to the room and told the players about the experiment. But they couldn't figure out how exactly I'd cheated. I had to hand over Joseph.
Expert Verdict: “Nothing to See”
After our players left, Sal Piacente came in to give his verdict.
“That was fantastic,” Sal said, grinning. “Gentlemen, that was great. It worked beautifully. You’re a dangerous individual, my friend — I wouldn’t want to be against you.”
Sal has watched thousands of hours of surveillance footage — including many real cheating attempts. How did our scheme compare?
“I thought it was right on top,” he said. “There’s nothing to see.”
We discussed the idea that our aggressive play style might have raised suspicions. “If we had played more conservatively, with just a small edge, it probably would have been even stealthier,” I suggested.
“Totally,” Sal agreed. “There’s no doubt this would have gone undetected.”
Beyond Poker: A Lesson in Trust and Technology
The real story here isn’t just about cheating at poker. It’s about trust — and how technology can be both a safeguard and a vulnerability.
As we add more “smart” components to everything in our lives — from household appliances to cars to medical devices — they all become more susceptible to manipulation and surveillance. If a smart card shuffler can be hacked to rig a poker game, what other devices might be vulnerable? Who else could manipulate the machines around us for an unfair advantage?
It’s a sobering thought — and a reminder that sometimes, the old-school analog ways of doing things are still the safest.
– At CoinPoker, shuffles are verified by a server-side hash function, and always guaranteed fair. Prove it for yourself in every hand, by using the simple RNG verification in the client.
