Does BluffKing Sell Cheats? Why Trust Its Anti-Cheat Defenses?
A player asked about cheat tools. BluffKing does not sell them. Here is how dealing proofs, public source code and a security bounty let you examine that claim—and where their limits lie.
A player asked me whether there were any “assist tools.” When I asked what they meant, the answer was: cheats.
I sent two links: our explanation of verifiable dealing in Texas Hold’em and the security bounty. I added that the goal was for nobody to be able to abuse the system.
That still leaves a reasonable question: why should you believe me? Anyone can claim strong security. Players need evidence they can examine, claims they can challenge and a way to investigate problems.
Another exchange began with: “Is there software for sale? I want to have some fun with my friends.” I replied that the software still had plenty of bugs, that I was fixing them every day, and linked to the changelog. Making problems and fixes visible is another part of being open to scrutiny.
Does BluffKing sell cheats?
BluffKing does not sell cheats or offer paid access to hidden hole cards, favorable deals or altered settlement. A third party claiming to sell those capabilities has not thereby proved that they work or that BluffKing authorized them.
That statement is different from claiming that no exploitable bug could exist. We cannot vouch for every third-party program or rule out unknown vulnerabilities with a promise. A claimed exploit needs a specific capability, stated conditions and a reproducible result.
Changing the two cards on your own screen to aces only demonstrates a display change. Making the server accept those altered cards and settle the hand accordingly would be a different capability. Guessing one river card correctly is not proof of reliable access to future cards.
Start with what you can verify
Default Hold’em supports verifiable dealing. Think of 52 opaque envelopes: an encrypted deck is committed first, then player randomness helps determine the dealing order. After the hand, players can check the deck proof and decryption proofs for cards they are entitled to see.
This does not expose everyone’s folded cards. The evidence lets you check that a visible card came from its prescribed position while other players’ unshown cards remain encrypted. The protocol, randomness assumptions and scope are explained in Texas Hold’em: Zero-Knowledge Proofs.
After a default-dealing Hold’em hand ends normally, a player dealt into that hand can open fairness verification from hand history or use the fairness verification page. Use the same account, device and browser where possible, so proofs can be compared with records captured during play.
- Full verification with local witnessing: the proofs pass, local evidence is complete and consistent, and required checks—including your randomness being included and nobody withholding a reveal—pass.
- Valid server records without complete local witnessing: the supplied proofs pass, but local records are incomplete. This is a narrower result.
- Failed or unavailable verification: inspect the failed checks or missing evidence. This is not a pass.
These checks concern dealing evidence. They do not establish that nobody colluded, used decision assistance or compromised an account or device. In default mode, the server still holds the secrets needed to decrypt cards: a valid proof does not establish that the operator is technically unable to know them. A tampered client could also display a false “passed” result, so the verification code itself needs scrutiny.
Public source makes the claims inspectable
BluffKing’s source code is public. Technical readers can inspect where hidden cards are sent, how identity and card-access permissions are checked, whether settlement trusts client-supplied cards and what the verifier actually checks.
Open source is an invitation to inspect, not proof of flawless software. Reviewing a source snapshot does not itself establish that production runs exactly that version. Our security bounty audit record provides a starting point; finding no exploit in reviewed paths is not a permanent guarantee.
What does the RMB 30,000 in the screenshot mean?
At the time of writing, the bounty lists three challenges. Each pays RMB 10,000 after reproduction and confirmation; demonstrating all three totals RMB 30,000:
- Predict community cards before reveal: know the exact cards, including suits and ranks, before the server reveals them.
- Obtain another player’s hidden hole cards: access cards that have not been made public.
- Change your hand in server settlement: make the server accept altered cards and settle using them. Changing only the browser display does not qualify.
The screenshot’s RMB 30,000 refers to the combined rewards, not a payment for any arbitrary issue. Consult the security bounty page for the campaign period, conditions and contact details. The bounty supplies a concrete reporting and verification route; the size of the reward does not prove security.
If you encounter a claimed cheat, preserve useful evidence
Keep the table or hand ID, time, sequence of events and screenshots or recordings. If someone sells a supposed cheat, preserve their specific claims; do not hand over your account or control of your device to find out whether they are telling the truth. Use the bounty page to contact the administrator with reproduction steps and supporting evidence.
An investigation should distinguish a display change from a server-side outcome, and a lucky guess from repeatable access to information a player should not have. Dealing verification also cannot replace a collusion investigation, which needs play patterns and other evidence. See our review of a collusion report for an example.
“Nobody can abuse the system” is our goal, not a technical conclusion covering every risk. You should not have to trust me because I built the game. You should be able to inspect evidence, present counterexamples and expect problems to be explained and fixed. That is the basis on which I want our anti-cheat defenses to be judged.