ParadisePoker.com Blackjack Cracked

By JackAceHole

In March, ParadisePoker.com added blackjack to their software so players could, "...enjoy a few hands of blackjack as [they're] playing poker!"

A few days later, my brother called me to tell me about it.  I immediately dismissed the game as being a losing venture.

Internet casinos do not typically offer favorable conditions for blackjack players even skilled card counters.  Internet casinos usually deal from an eight deck shoe (the more decks, the worse the advantage for the player) and they shuffle after every hand.

This makes card counting impossible and renders the game unbeatable.  My brother insisted that the game was good because he was fairly certain that there was an exploitable bug.

"I don't know if this makes the game beatable or not, but every time the dealer has an ace showing, it takes them an extra long time to ask me for insurance when they have a ten in the hole.  When they don't have the blackjack, the insurance prompt comes up immediately."

I shook my head in disbelief and quickly started formulating how much money I could transfer from my other poker accounts into my Paradise account.  I knew that this would be a huge money maker if it were true.

The Edge

The insurance bet is a side bet that the casino offers when the dealer has an ace as his initial up card.

If you take the insurance bet and the dealer has a ten-valued card in the hole, you win one bet.

If you take the insurance bet and the dealer does not have a ten-valued card in the hole, you lose half of one bet.

So if you initially bet $100, you are given the opportunity to prevent yourself from losing $100 if the dealer has a winning blackjack.  (You will win $100 on the insurance bet but lose $100 on the initial bet.)

It doesn't sound like much, but you will essentially have $100 more than if you didn't know about the exploit.

Given the rules of the game, the house edge was 0.56 percent, assuming that you play perfect "Basic Strategy."  Basic Strategy is the best way to play your hand when all you know is what you have and what the dealer has showing.  When the dealer has an ace exposed, Basic Strategy tells you that you should never take insurance.  It is an unprofitable bet in the long run.

The dealer will have an ace as his up card approximately once every 13 hands.

Four out of 13 times, the dealer will also have a 10 in the hole.  This means that you would get to exploit this bug approximately four times every 169 hands (1/13 * 4/13).

This translates to a 2.366 percent more favorable situation for the player.  Without the exploit, you would expect to lose 56 cents for every $100 bet.

So with the exploit, this translates to a 1.778 percent player advantage (or $1.78 for every $100 bet) over the house without card counting.  The table limit for the Internet game was $300 per hand.

Playing quickly, a person can play four hands per minute (240 hands per hour).  This means that this exploit was worth over $1,280 per hour for the well-funded player ($300 * 240 hands/hour * 0.01778 edge)!

The Attack

I logged into ParadisePoker and started playing blackjack.

I was betting ten cents per hand (the table minimum) until I confirmed the bug.  Every time the dealer had a ten in the hole, I would have to wait one or two seconds for the insurance prompt to show up.

When he didn't have the ten, it would come up immediately.  After making perfect insurance bets eight out of eight times, I decided my brother was right.  I got down to business and started making $20 bets.  As my bankroll grew, so did my bet size.

Pretty soon, my $400 turned into $800.  $800 turned into $2,000. $2,000 turned into well over $6,000 and there was no sign of stopping!

I finally stopped after seven hours because my eyes were shot and I just couldn't stay awake anymore.  I decided to take a 12 hour break to sleep (it was four in the morning), check in at work, and see whether my actions triggered any red flags in ParadisePoker's monitoring system.

The End of the Line

The next morning I went to work and told my boss that I was going to take a few days off.

I made over one month s salary in less than seven hours so I was not going to let a pesky thing like work get in my way.  While I was there, I got another call from my brother, "I've been playing for about an hour and it looks like they fixed the bug."  I rushed home in disbelief. After a few minutes, I confirmed my brother's bad news.  I tried to find other exploits for several more hours, but my efforts were fruitless.

After I was sure the bug no longer existed, I withdrew the majority of my winnings from my account.  I was afraid that they might think I was cheating, so I wanted to make sure the money was out of their system before they froze my account.  Technically, neither my brother nor I did anything wrong.

We didn't decrypt network packets and we didn't hack their servers.  We were just very observant and relied on nothing but our sense of timing.

When finding an exploit like this, it is difficult to determine how far to push the envelope.

An opportunity like this only comes once every few years.  The flaw was very noticeable and I was surprised to see it up for as long as it was.  (I assume that it was up since the blackjack feature launched six days earlier.)

I am sure that all casinos (both Internet and brick and mortar casinos) have monitoring checks in place when someone is winning big.  It is impossible to know what these thresholds are without working for the company.

In the U.S., casinos are required to fill out a Currency Transaction Report (CTR) if a player makes more than $10,000 in cash transactions in a 24-hour period.  Even though ParadisePoker is not U.S. based, I was not sure whether they would issue the CTR.

I decided to stop a little shy of this limit in hopes of staying under Paradise's radar.  Apparently, I did not manage to stay in the clear.

I know that some people will be upset with my actions.  There were probably a few people out there who knew about the exploit but were content in winning a few hundred dollars a day.

It is possible that I could have won more by stretching out my winnings over time instead of going for the throat, but I highly doubt it.

This bug was just too easy to stumble across and I knew that they would fix it in a few days for one reason or another.

I feel I chose the path that maximized my winnings and I am more than happy with the results.

The Links

ParadisePoker News: www.paradisepoker.com/news.html

ParadisePoker Blackjack Rules: www.paradisepoker.com/blackjack.html

Wizard of Odds: Basic Strategy: www.wizardofodds.com/blackjack

Wizard of Odds: House Advantage Calculator: www.wizardofodds.com/blackjack/house-edge-calculator.html