Essay

Why fraud models should only propose. By Amir Shachar.

Read the essay
Skip to content
Riskernel

Teardowns · 001

DraftKings 2022: how stolen logins became withdrawals

By Riskernel · · Sources accessed 2 November 2026

Attackers did not break in. They logged in with passwords leaked elsewhere, added their own payment method, and withdrew the balance.

How to read the tags. Confirmed means a public source we cite states it. It does not mean we verified it ourselves. Not yet confirmed is a hypothesis we would test in a review. The US Department of Justice did not name the betting site in the material we read. Outlets link the charges to the DraftKings incident because the details match [3][4], so we treat that link as the outlets’ inference.

Court and regulator detail is cited as reported. Court and sentencing detail on this page is taken from the reporting in [2][3][4]. The primary record is the Justice Department release from the Southern District of New York, “Third Defendant Sentenced To Prison For Hacking Fantasy Sports And Betting Website” (23 June 2026).

Events November 2022 (attack); December 2022 (company disclosure); January 2024 to June 2026 (charges and sentences)

What happened

In November 2022 an attacker group ran a credential-stuffing attack against DraftKings. Credential stuffing means trying username and password pairs leaked from other companies’ breaches, at machine speed, on a different site [1][2]. DraftKings told the Maine Attorney General that 67,995 individuals were affected, and said the incident was a credential-stuffing attack and “not a breach of DraftKings’ systems” [1].

According to a complaint reported by BleepingComputer, the defendants sold access to hijacked accounts through their own online shops and in bulk to another seller. Buyers were told to add a new payment method, deposit five dollars to verify it, then withdraw all existing funds to a separate account under the defendants’ control [2]. BleepingComputer reports the buyers stole around 635,000 dollars from roughly 1,600 accounts [2]. SecurityWeek and Help Net Security, citing the Justice Department, report about 600,000 dollars from 1,600 accounts [3][4].

DraftKings said it would “restore all the stolen funds” [1]. BleepingComputer reports that one month after the attack the company said it had refunded hundreds of thousands of dollars to the 67,995 customers [2]. Three defendants have since been sentenced, to 18, 30 and 18 months in prison [3][4].

Attack tree

How the flow was abused.

Root goal: cash out accounts the attacker does not own. Leaves marked Hypothesis are ours to test, not facts from the record.

GOAL Cash out accounts the attacker does not own
  1. AGet valid logins
    1. A1Credential stuffing with pairs leaked elsewhere
    2. A2Buy ready-made hijacked accounts from a “shop”
  2. BGet through the front door at volume
    1. B1Automated login tooling and large wordlists
    2. B2Test: does a login from a new device need extra proof?Hypothesis
  3. CMove the money out
    1. C1Add a new payment method, make a five-dollar verification deposit, withdraw everything
    2. C2Test: withdrawal to a method already on the accountHypothesis
  4. DMonetise access
    1. D1Sell accounts in bulk to a reseller
    2. D2Sell single accounts through their own shop
Public record Built from public reporting (SecurityWeek, BleepingComputer, Help Net Security); court details are as reported through those outlets. High, Medium and Low are our qualitative judgement of likely loss per leaf, not dollar estimates.

Findings

Confirmed 5

F-01 Confirmed

DraftKings says the logins came from other companies’ breaches, not its own systems.

DraftKings told customers attackers “may have previously gained access to your username or email address and password” from a non-DraftKings source, and said the incident was “not a breach of DraftKings’ systems”.

F-02 Confirmed

The attack touched about 68,000 people.

DraftKings reported 67,995 individuals to the Maine Attorney General. The Justice Department figure in later coverage is “more than 60,000” accounts. The sources do not reconcile the two numbers.

F-03 Confirmed

The cash-out route was a new payment method plus a five-dollar verification deposit.

Per the complaint as reported by BleepingComputer, buyers were told to add a new payment method, deposit five dollars to verify it, then withdraw all existing funds to a separate account. Help Net Security says that “in some cases” the group added payment methods under their control.

F-04 Confirmed

The group had industrial tooling.

Devices seized from two defendants held hundreds of “configs” for credential-stuffing tools (OpenBullet and SilverBullet) and dozens of wordlists with tens of millions of username and password combinations.

F-05 Confirmed

Reselling hijacked accounts was a business of its own.

Reported theft was about 600,000 to 635,000 dollars from about 1,600 accounts. One defendant’s shop is reported to have made 2,135,150.09 dollars across 225,247 “products” in court documents, covering hijacked accounts from more than one company. The sources do not say how much of that came from this incident.

Not yet confirmed 2

F-06 Not yet confirmedHypothesis

Test: does a first withdrawal to a newly added method wait for a hold or a step-up check?

No source we read says what checks ran between “payment method added” and “withdrawal paid.” We would test whether a first withdrawal to a new destination is delayed, capped or challenged, and whether the verification deposit itself is a signal.

Evidence
No public source we read states this. Sources read: [1] SecurityWeek, 20 December 2022 · [3] SecurityWeek, 24 June 2026
F-07 Not yet confirmedHypothesis

Test: is one tool logging into many accounts visible before the first withdrawal?

The sources describe the tooling, not what the operator could see. We would test whether failed-then-successful login ratios, shared device or network traits across many accounts, and logins from machines that never touched the account before would have separated this run from normal traffic.

Evidence
No public source we read states this. Sources read: [2] BleepingComputer, 30 January 2024

The three controls that matter most

For a fintech about to launch a wallet, a payout feature or a betting-style balance:

  1. Treat “new payout destination” as a high-risk event. Require a fresh proof from the real owner (not just a login) before a new bank, card or wallet can receive money. Hold or cap the first withdrawal to any newly added destination. Do not let a small verification deposit count as proof of ownership.
  2. Detect stuffing at the login, not at the withdrawal. Score logins by what the sources say the attackers did: automated tools, many accounts per device or network, bursts of failures followed by successes, and credentials found in breach lists. Slow or challenge those logins before the session can reach money movement.
  3. Score the sequence, not the single step. “Login from a new device, then payment method added, then verification deposit, then full-balance withdrawal” is one story. Each step looks routine alone. Scored together inside one short window, it should trigger a hold.

Sources

Date accessed for every source: 2 November 2026. Numbers on this page are only those a cited source states. Headlines are quoted with any dollar figure written in words, in square brackets.

  1. SecurityWeek. “DraftKings Data Breach Impacts Personal Information of 68,000 Customers.” Published 20 December 2022. Accessed 2 November 2026.
  2. BleepingComputer. “US charges two more suspects with DraftKings account hacks.” Published 30 January 2024. Accessed 2 November 2026.
  3. SecurityWeek. “Third DraftKings Hacker Sentenced to 18 Months in Prison.” Published 24 June 2026. Accessed 2 November 2026.
  4. Help Net Security. “Hacker gets 18 months for attack that compromised 60,000 betting accounts.” Published 25 June 2026. Accessed 2 November 2026.

Court and sentencing detail on this page is taken from the reporting in [2][3][4]. The primary record is the Justice Department release from the Southern District of New York, “Third Defendant Sentenced To Prison For Hacking Fantasy Sports And Betting Website” (23 June 2026).