Crypto Casino Security: The Settings for Each Account, and the Threat They Miss

The accounts, who controls each, and what threatens it

• Exchange — What it holds: The asset after purchase, before withdrawal · Who controls it: The exchange, under FCA money-laundering supervision · Main threat: The exchange's own failure or a login compromise
• Wallet — What it holds: The asset under your keys · Who controls it: You · Main threat: A lost recovery phrase; a transfer sent to the wrong network or address
• Casino — What it holds: The balance after a deposit is credited · Who controls it: The operator, under its licence conditions if any · Main threat: The operator not paying; a login compromise

The scale on our main page scores only the third column's last row, under criterion 1, and the casino-side settings under criterion 7. The rest is yours, and the sections below are the settings.

The exchange

An exchange registered with the Financial Conduct Authority under the money-laundering regulations is supervised for money laundering and terrorist financing. That is what registration means; the FCA tells registered firms not to present it as an endorsement, describes crypto as largely unregulated, and warns that compensation from the Financial Services Compensation Scheme is highly unlikely if an exchange fails. An exchange account is custodial: the exchange holds the keys and you hold a login.

Settings. A second authentication factor on the login. A withdrawal address whitelist where the exchange offers one. An email address used for nothing else. Custody habit. Buy the amount decided for the session and withdraw it to a wallet you control; an asset left on an exchange beyond that is exposed to the exchange's solvency for no reason connected to the games.

The wallet

A wallet you control holds the asset under keys that no company can reset. The recovery phrase regenerates the keys; anyone with it has the balance, and the commonest way crypto is lost without being stolen is a phrase saved as a screenshot, a note or a cloud backup that is later compromised or lost.

Settings. The recovery phrase on paper, in one place, never photographed. Every authentication option the wallet offers. A dedicated wallet for casino play, holding only the stake, so that what a casino's address can be traced to is what you chose to put there. Cold storage, a wallet not connected to the internet, for anything held between sessions, as the top-ranking UK guides recommend.

The transfer. The wallet is also where the one unrecoverable error is made: a send on a network other than the one beside the casino's address, or to an address swapped by clipboard malware on a phone. The defences are a comparison of the network label in the wallet against the cashier, a check of the first and last characters of a pasted address, and a small test transfer the first time an operator, asset, network or wallet is new.

The casino

Once a deposit is credited, the asset is in the operator's wallet and your balance is a line in its records that it has undertaken to honour. The security of that line has two parts: the login, which settings protect, and the operator, which they do not.

Settings. A second authentication factor on the account. A withdrawal address whitelist where the operator offers one, so that a stolen login cannot send the balance anywhere new. The protection tools scored under criterion 7, a deposit cap, a cooling-off period and self-exclusion, which are security settings against yourself. Verification completed before the first deposit, so that the first withdrawal is reviewed as a withdrawal rather than as an introduction.

Custody. A Gambling Commission licensee must tell you, before your first deposit, what protection applies to customer funds if it becomes insolvent; the disclosure is mandatory, the protection is whatever the disclosure says. An overseas operator has no such duty, and the balance is an unsecured claim on a company abroad. The habit that reduces the risk is the same at both: withdraw what is not about to be staked.

The threat no setting reaches

Every setting above protects the player from theft and from their own errors. None protects the balance from the operator, and the operator is where the whole balance is at risk. The Gambling Commission's report on illegal online gambling lists what unlicensed sites typically lack, age verification, responsible gambling tools, secure payment systems and a dispute resolution scheme, and its blog records withheld payouts, unreachable withdrawal limits and the risk of identity theft among the outcomes it sees.

The protection against that threat is the licence, which is why criterion 1 carries forty points and this page's settings carry none.

A Gambling Commission licensee verifies identity before play, belongs to GamStop, discloses how customer funds are held, and must offer free dispute resolution after eight weeks; an overseas operator is bound by none of that, and the Commission says a licence from another country does not permit an operator to serve consumers in Great Britain. A second factor on a login at an operator that will not pay is a secure door on an empty room.

Why the scale leaves security to the player

Two of the three accounts are chosen by the player before an operator is involved, and the operator cannot be scored for an exchange it did not pick or a wallet it does not hold. The third account's settings, where the operator does control them, are scored under criterion 7 as protection tools and under criterion 3 as cashier disclosure, including whether a withdrawal whitelist is offered.

What remains, the operator's willingness to honour the balance, is criterion 1 by another name. Scoring "security" as a separate line would either double-count those criteria or reward the presence of a padlock icon, and the scale does neither. The honest statement is that a crypto casino's security is mostly in the player's hands, and that the part which is not is called the licence.

A reader who wants a single figure for an operator's security will not find one on the cards. The reader will find whether the operator offers a whitelist and the three protection tools, which regulator issued its licence, and whether its terms exclude the United Kingdom; those are the parts of security the operator decides, and they are the parts the cards record.

Provably fair, and what kind of security it is

Operators often list provably fair games under security, and the scale scores a working tool under criterion 6 for five points. It is a fairness check for one family of game: the hash of a server seed is published before a round, the seed is revealed afterwards, and the result can be recomputed. It verifies that the round was not altered after your bet.

It is not a security setting in the sense of this page, because it protects nothing you hold; it tells you that a game you already played was played as committed. The leading UK guides suggest a check at the end of each session, and an independent hash calculator once, to confirm the operator's own tool is honest.

The settings, listed per holding

1. Exchange: second factor; withdrawal whitelist where offered; dedicated email; nothing held beyond the session's stake.
2. Wallet: recovery phrase on paper only; every authentication option on; a dedicated wallet for play; cold storage between sessions.
3. Transfer: network label matched; pasted address checked at both ends; test transfer first.
4. Casino: second factor; withdrawal whitelist; deposit cap, cooling-off and self-exclusion set; verification done before the first deposit; nothing idle in the account.
5. Operator: licence looked up in the regulator's register; terms searched for a clause excluding the United Kingdom.

The fifth line is not a setting and is the only one that reaches the whole balance. You must be 18 or over to gamble in Great Britain; if gambling is causing harm, the National Gambling Helpline, run by GamCare, is free on 0808 8020 133 at any hour.

Sources

• FCA, cryptoassets AML/CTF regime
• FCA, crypto basics
• Gambling Commission, LCCP (4.2.1, 6.1.1, 17.1.1, 3.5.5)
• Gambling Commission, how we tackle illegal gambling
• Gambling Commission, public register
• Gambling Commission, organisations that can help
• Gambling Act 2005