A fake JSON library sat in the NuGet catalog for nearly two months. It differed from the original by just a single letter: instead of Newtonsoft.Json, the hackers used Newtonsoftt.Json.Net.
Developers could have installed it by mistake. The library functioned as expected, but in the background, it searched the server for a specific crash game from Digitain to tamper with its results.
Hack Mechanics
The trojan tampered with the crash multiplier for selected rounds in advance. Rather than rigging every game indiscriminately, it targeted specific rounds according to a hidden schedule. This was done to avoid sudden statistical spikes and evade fraud detection systems.
In newer versions of the malicious code, the trojan also exfiltrated this data to the hackers' server. Knowing the outcome ahead of time allowed them to place bets and cash out at the right moment.
JFrog researchers identified seven such versions of the library that were published to the catalog.
Why an Insider is Suspected
The code was targeted not at crash games in general, but at a specific internal module from Digitain. The trojan's author knew the exact name of the function responsible for round outcomes and even left a reference to the company's private working repository in the files.
Because of this, JFrog suggests that a current or former employee with access to the source code may have been involved in creating the trojan. For now, this remains a theory without direct proof.
JFrog shared its findings with the company in July 2026. Two days later, Digitain replied that they were already aware of the issue and had resolved it. However, JFrog did not confirm that the trojan ever ran on production servers. There is currently no information on financial losses or bets placed with pre-known outcomes.
Impact on Media Buying
This story does not directly impact ad accounts or traffic sources. However, following such incidents, casinos and providers may tighten their anti-fraud controls.
They tend to scrutinize large wins more thoroughly and may temporarily place payouts on hold for suspicious accounts. Traffic with an abnormally high win rate heavily focused on crash games will come under particularly strict review. If your leads are placed on hold during this period, the reason might not be traffic quality, but an internal review by the casino or game provider.
