Journalist proves: Hacking automatic shuffle machines makes cheating in poker possible

Andy Greenberg, a journalist for the American magazine WIRED (focusing on topics such as technology, culture, economics and politics), together with a security researcher, took the initiative to demonstrate that cheating at the poker table can be made possible by hacking automatic shuffle machines.

And their research revealed several vulnerabilities, such as in the popular shuffle machine Deckmate 2.

What is an automatic shuffle machine? 

An automatic shuffle machine takes over the dealer’s work, preventing employees from colluding with customers. This automatically shuffles the cards during dealing, making them popular in casinos. At the same time, the dealer no longer needs to perform this task himself.

The design requires them to eliminate any directed movements during shuffling, and today, the latest shuffle machines are even fully computer-controlled. The unpredictability and randomness of shuffling fascinates both players and casinos. Automatic shuffle machines are now a common sight at the gaming table.

Research proves shuffle machine can be manipulated

Journalist Andy Greenberg demonstrates this in his recent research article, in collaboration with security researcher Joseph Tartaro of IOActive, a company active in various areas of computer security. Together, they succeeded in building a prototype that provided access to the shuffle machine’s internal camera via an unprotected USB port.

The camera’s purpose is actually to check whether all 52 cards are present. But this research proves that the images can also show the order of the shuffled cards, which indeed makes cheating possible. By connecting a small module to the USB port, this task can be accomplished; the order is read and sent to a smartphone via Bluetooth.

Joseph Tartaro: 

“We wanted to demonstrate that this is technically possible, not to exploit it. But it does show that the security of these devices is lagging behind the reality of 2025.”

They effectively tested their research

They put their research into practice and conducted an effective test. But they didn’t do this in a casino. Journalist Andy Greenberg got to work, and he’s anything but an experienced poker player himself.

But through signals he received from his partner, he knew which cards were coming and therefore also when to fold if he was going to lose and when to raise if he knew he could win.

During such private games, the risk of cheating is a real one. It’s not the player, who, in this case, doesn’t even need to know the rules, but the technology that controls and subsequently dominates the game. And in this case, there’s not even any physical supervision.

How is this even possible?

You’d be amazed at how easy it is to cheat in a game where knowing the rules is so crucial. Here’s a quick overview of this method.

1. Getting access through USB port
   The Deckmate 2 has this for maintenance and firmware updates. Once accessed, someone can then connect a mini-computer like a Raspberry Pi or a microcontroller. This gives you access to the device’s internal processes.
2. Internal camera normally serves for checking
   Are all 52 cards present in the deck? That’s what the camera is for, but this research proves that it’s also possible to record the precise order. Reading the camera feed via the USB connection is all that’s needed to determine the order.
3. Sending via Bluetooth to smartphone
   A wireless transfer via Bluetooth to a smartphone allows a player to immediately anticipate the course of the game, because the card order is known.
4. Pay attention to vulnerability
   John Tartaro points out that it’s especially important to be vigilant with older and second-hand Deckmate machines. These are particularly vulnerable, especially during unsupervised private or home gaming. Regular casinos generally monitor firmware updates and perform physical checks.

Light & Wonder has already responded

Manufacturer Light & Wonder has already responded, stating that firmware updates have been implemented to optimize security. The manufacturer also states that all shuffle machines in official casinos are up-to-date and that there is no evidence of cheating in this way.

However, security expert John Tartaro warns:

“Once a Deckmate is sold second-hand or ends up off the casino floor, it’s impossible to guarantee that security remains intact.”

Because this research demonstrates that even advanced technology within the casino sector can be vulnerable to abuse. Although casinos do comply with firmware updates, unmonitored private games remain a potential risk.

Curious about the video of this research? You can watch it on WIRED’s YouTube channel.