YT YouTube2Text

YouTube2Text → Transcripts → Cómo un Ruso Robó $20 Millones a Casinos

Cómo un Ruso Robó $20 Millones a Casinos — Transcript

by VEGAS español · 3,467 words · 553 segments · language en · Watch on YouTube

Open in transcriber Summarize with AI Download SRT/VTT

Full transcript

0:00Lumiere Place Casino, St. Louis,
0:04Missouri, June 2, 2014, 8:14 p.m. You
0:08see a man sitting at a slot machine.
0:13He’s in his 30s, looks ordinary. Blue
0:17long-sleeved shirt. He holds his phone
0:20near the screen, just like thousands of
0:22people in this casino do every night.
0:24He seems to be watching something, a
0:27game perhaps, or some videos. But here
0:30is what you don’t see. The phone is
0:32not connected to the machine. There are
0:34no wires, nothing attached to the
0:36interior. That machine, an Aristocrat
0:39Mark VI, the most widely distributed
0:42model in the world, present in over
0:44100,000 casinos in 42 countries, is
0:46working exactly as it was designed to
0:48work. What this man is recording
0:52isn’t the symbols on the screen,
0:54it’s the exact milliseconds each reel
0:57stops. In 4 minutes, that recording
1:00will cross the Atlantic. On Tuesday and
1:03Wednesday, this man will return. By the
1:06time Wednesday is over, the casino’s
1:08vaults will have lost $ 21,000 without
1:11a single jackpot, without any
1:13extraordinary result. The machines will
1:16have done exactly what they were
1:18programmed to do, and that is exactly
1:20the problem. How does a mathematician
1:23from St. Petersburg crack the algorithm
1:25of a machine made in Australia? He
1:28deploys teams in Poland, Macau, Peru,
1:30and Missouri, and spends 9 years
1:32building an operation that extracts
1:35between 16 and 20 million dollars from
1:37the most surveilled gambling industry
1:40in the world. The answer starts long
1:43before Bev’s phone. It starts in 2006
1:46with an assignment that seemed routine
1:49and with a question that no one in the
1:51gambling industry had bothered to ask.
1:55St. Petersburg, Russia, 2006. Alex is
1:59in his 30s. He doesn’t use his last
2:02name in public. He works as a freelance
2:04programmer and, in the terminology of
2:07certain private Russian forums, as a
2:09hacker for hire. He studied
2:11cryptography at a military university
2:14in St. Petersburg, the kind of training
2:16that in the 90s produced the world’s
2:19best hackers, and in the 2000s produced
2:21the world’s best security analysts,
2:24depending on which side you were on. In
2:27an interview he will give 11 years
2:29later, he will say this. As a
2:31mathematician, I understood from a
2:33young age how probabilities work.
2:35Gambling always seemed to me like a tax
2:37on stupidity. In mid-2006, a Moscow
2:40casino hired him for a specific job.
2:44Its slot machines, manufactured by
2:47Novomatic, an Austrian company present
2:49in 91 countries, were programmed to
2:52return 90%of wagered money to the
2:54player. The casino wanted to reduce it
2:57to 50%. The job required accessing the
3:00machine's source code, understanding
3:02the logic that turns an internal number
3:05into a visible result on the screen.
3:08Modifying it, then sealing it up
3:09without leaving any physical trace. It
3:12took Alex 6 months to complete it, and
3:14in those 6 months, he found something
3:16no one had asked him to look for. After
3:19turning in the work, he spent another
3:21six months doing something the
3:23Novomatic engineers hadn't. Carefully
3:26reading the system that generated the
3:29results, the pseudo-random number
3:31generator, the algorithm that turned
3:33chance into something that looked
3:35random, but followed fixed rules. "I
3:38mastered it to the point where I can
3:40develop these algorithms myself, to a
3:42level I have yet to see in any gaming
3:44machine," he said. "It's in my blood; I
3:47feel the numbers, I know how they move.
3:50" It wasn't arrogance; it was a
3:53technical description. The gambling
3:55industry has been built for 70 years.
3:58On one claim: slot machines are
4:01completely random. The claim is correct
4:05and deeply misleading. A computer
4:08cannot generate true randomness. What
4:10it generates is a pseudo-random number,
4:13the result of an algorithm that takes
4:15an initial number, a seed, and
4:17processes it through math until it
4:20produces a sequence that seems
4:22impossible to predict. The sequence can
4:25be enormously long, but it is fixed,
4:27deterministic. If you know the seed and
4:31the algorithm, you know every result
4:33that machine will produce from that
4:35moment on. Aristocrat Leisure is an
4:38Australian company founded in 1953. In
4:43the 90s, it designed the Mark VI, a
4:45line of cabinets that became the most
4:48widely distributed model in the world.
4:50By 2014, there were over 100,000 active
4:54units in 42 countries. The same code in
4:57the slots of a Macau casino as in those
5:00at Lumière Place in St. Louis. The
5:03Mark VI generator used a 64-bit state.
5:07The base algorithm was 36 years old
5:10when Aristocrat implemented it. It had
5:12been in the public domain since 1972.
5:16Documented; any software engineer could
5:19read it in a university library.
5:22Aristocrat built its most widely
5:24distributed machines using an algorithm
5:27any math grad could find without paying
5:29. A single cent. No one at Aristocrat
5:33thought it was a problem because no one
5:35believed anyone could use that
5:38knowledge to predict results without
5:40direct physical access to the machine.
5:43In 2006 that was still true, but in
5:462009 two things changed at once. On
5:49July 1, 2009, Vladimir Putin signed the
5:52new Russian gambling law. From that
5:56date on, casinos could only operate in
5:58four special zones on the fringes of
6:00the territory. In practice, a total
6:04shutdown. Thousands of casinos
6:06liquidated their assets. In weeks,
6:08machines worth between $ 8,000 and $
6:111,000 were sold for tens. An
6:15organization in Saint Petersburg bought
6:18lots of Aristocrats at scrap price and
6:21opened them up. Alex didn't look at the
6:24results when he studied the machines.
6:27He looked at the time between results,
6:29the invisible pattern that visible data
6:31left on the internal clock system. A
6:34Mark machine generates thousands of
6:36numbers per second in a continuous loop
6:39. When the player hits spin, the system
6:42captures the number the generator
6:43produces in that exact microsecond. The
6:47same button pressed 0.3 seconds earlier
6:49produces a completely different result.
6:53But the sequence isn't chaotic; it's
6:55linear. Deterministic; if you observe
6:59the results of the last 20 spins, you
7:01can calculate the current state of the
7:03generator. Alex knew this. What he
7:07didn't have in 2007 was technology to
7:09transmit that information to someone at
7:12the machine in real time with
7:14millisecond precision. In 2009, the
7:17iPhone 3GS changed everything. In 2008,
7:20with Novomatic's data already decrypted
7:23, Alex hired his first team. The
7:26protocol had four phases. First,
7:29reconnaissance. A field agent would
7:32arrive at the casino with a prepaid
7:34phone bought with cash that same day.
7:37Never their own phone. They would sit
7:40at the machine and record between 20
7:42and 24 spins. The rear camera pointed
7:45at the screen at an angle of 30 to 40
7:47degrees, enough to capture the results
7:50accurately. Enough to look accidental
7:53if someone were watching from behind.
7:56Second, transmission. The video was
7:59sent encrypted via mobile data to a
8:01server in Saint Petersburg. Third,
8:04analysis. Alex's assistants ran the
8:08reconstruction algorithm. The time
8:11stamps from the video frames gave them
8:13the chain of the generator's recent
8:15states, like reading clock hands to
8:17know how long it's been running. The
8:20process took between 15 and 40 minutes.
8:24The result: a list of future timestamps
8:27, the exact moments with a margin of
8:29error under a tenth of a second when
8:32that specific machine's generator would
8:35produce a winning combination. Fourth,
8:39execution. Those timestamps traveled
8:42back to the agent's phone as
8:44synchronization data. A custom app
8:47converted them into scheduled
8:49vibrations. The agent felt the pulse,
8:52waited 0.25 seconds—the average human
8:56reaction time—and hit spin. Alex's
9:00commission was between 40 and 50%of
9:02each team's revenue. The rest went to
9:05the agent and the middlemen. Alex
9:08recruited over the internet. He never
9:10met his agents in person. If one was
9:13caught, they couldn't describe any part
9:15of the central structure. I only knew I
9:18was following vibrations. From 2008 to
9:202011, the team operated in Eastern
9:23Europe. Novomatic was the first target.
9:27In March 2011, Novomatic distributed an
9:29internal memo to its clients. Some of
9:33their generators might have been
9:35compromised; they had no suspect, just
9:37payout logs that didn't add up. By then
9:40, Alex had spent months with an
9:42Aristocrat Mark disassembled on his
9:45desk. It took him 4 months to crack its
9:48generator. After that, the Novomatic
9:51operation took a backseat. A team of
9:55four coordinated agents could bring in
9:58over $ 250,000 in a week under optimal
10:00conditions. No one at Aristocrat had
10:03received any warning. No one at
10:05Aristocrat knew their machines were
10:08vulnerable. June 2, 2014. St. Louis,
10:13Missouri, 8:14 PM. Murat BL, 37 years
10:17old, passport from St. Petersburg. He
10:20has been working for the organization
10:22for 3 years. He has operated in Poland,
10:25in Macau, and in a Saigon gambling hall
10:27he will never speak of in any court. He
10:30arrives at Lumière Place at 8:14 PM.
10:33Right pocket, a prepaid phone bought
10:36that morning at a downtown shop. Left
10:39pocket, $ 400 in cash. Left wrist, a
10:43cheap analog watch. Digital ones emit
10:46radiofrequency signals. Analog ones do
10:50not. He chooses an Aristocrat Mark VI
10:53in the central area of the floor. The
10:56security guard's blind spot. He sits
10:59down, orders a Coke, takes out his
11:01phone. The rear camera over the screen
11:05does 24 spins. The last four are spaced
11:09out; he needs the frame timestamps well
11:12separated so the reconstruction
11:14software can work precisely. At 8:19 PM
11:18, the video heads to St. Petersburg. It
11:21is 4:19 in the morning there. Alex's
11:25assistants don't sleep during American
11:28operations. At 8:51 PM, the sync data
11:31arrives on Bleev’s phone. 15
11:35timestamps. The first vibration in 16
11:38minutes. Bleev orders another Coke. His
11:42right hand lies flat on the surface
11:45near the buttons. At 9:07 PM, the phone
11:48vibrates in his left pocket. He counts
11:510.25 seconds. He presses. The machine
11:54pays out $ 340. No celebration, no
11:58visible expression. He collects the
12:01voucher with the same face someone
12:03would have recovering what they’d
12:04been losing all night. 4 minutes later.
12:08Second vibration. $ 220, 5 minutes, 180
12:14, 7 minutes, 95, 11 minutes, 340 again.
12:22In a 47-minute session, Bleev makes $
12:251,175. On a machine that under normal
12:30conditions produces that return in a 12
12:32-hour shift. At 9:56 PM. He cashes out,
12:36leaves, and returns the next day. Two
12:39different machines. The protocol is
12:42repeated in both. By June 4th at
12:45midnight. The Lumier Place control
12:47system has a record that shouldn't
12:50exist. Two consecutive days of Negative
12:53Hold, when machines give out more than
12:55they take, with no major jackpot to
12:57explain it. $ 21,000 in net losses on
13:01the same machine model. Marcus Coms,
13:05the casino's security director, has 28
13:07years in the gaming industry. He has
13:11seen an occasional negative hold. Two
13:13days in a row on the same model, with
13:15no jackpot, is something else. He
13:18requests the recordings. His analysts
13:20review them for 6 hours and then find
13:23the man with the phone. A machine
13:26cannot lie. CS calls the FBI. On June 9
13:30, 2014, the FBI for the Western
13:32District of Missouri has the name Murat
13:35Bief. They have his photo from eight
13:38different casino camera angles. They
13:40have his car rental records and his
13:43flight out to Moscow on the 6th, 3 days
13:46before the alert. The special agent on
13:50the case requests technical advice from
13:52Aristocrat. The response arrives in 48
13:55hours. Their machines cannot be
13:57manipulated this way. The Mark VI's
14:00PRNG is complex enough to resist any
14:03attempt at external prediction.
14:07Aristocrat says that because they have
14:08never looked at what Alex has been
14:10studying for 5 years. Darrin Hawk is
14:12the director of surveillance at the
14:14L'Auberge du Lac Casino Resort in Lake
14:17Charles, Louisiana. When he receives
14:20the internal alert about Lumiere Place,
14:22he spends two weeks reviewing his own
14:24logs. He finds similar patterns on
14:27eight Mark VI machines in his room over
14:29the last 18 months. Different players,
14:33different shifts, different days,
14:36always the same model. Hawk checks
14:40local hotel logs, car rentals, and
14:43international flight arrivals at
14:45Lambert Airport in the previous 60 days
14:48. There is a pattern. Russian passports
14:52, flights from Moscow or Saint
14:54Petersburg, car rentals in individual
14:56citizens 'names. Russians, two or
15:00three-night stays in two-star hotels
15:02near the casinos. Hawk shares the
15:05information with the FBI and with Willy
15:08Allison, a Las Vegas security
15:10consultant, who has been tracking
15:12similar incidents in North America for
15:14almost 3 years. What Allison has in his
15:18database is a map. The map shows 43
15:22affected casinos in 11 states between
15:25May 2011 and June 2014. On November 15,
15:302014, two operatives from the
15:32organization are arrested at the
15:34Pechanga Resort Casino in Temecula,
15:36California. The State Department of
15:39Justice acts following a joint tip from
15:41the FBI and the California Gambling
15:43Control Commission. The agents seize
15:46four phones, $ 6,000 in cash, and
15:48encrypted communication logs between
15:51the operatives and the central server.
15:54The messages are encrypted, but the
15:57metadata—transmission times,
15:59durations, and activity patterns—show
16:01a flow that always ends at an IP
16:04address geolocated in northwest Russia.
16:07Saint Petersburg; the FBI has enough
16:10for active monitoring on American soil.
16:13The organization in Saint Petersburg
16:15doesn't know it. On December 10, 2014,
16:18Murat Bliev lands at Lambert Airport in
16:21Saint Louis. The organization sends him
16:24back. In Saint Petersburg, they believe
16:27Bliev was identified at the time but
16:30never formally charged. He is a proven
16:32agent. They need him. Three men arrive
16:36with Bliev. Ivan Gudalov, 32, Igor
16:39Lavrenov, 28, and Evgeni Nazarov, 38,
16:43an American citizen residing in Miami.
16:47The four of them rent a car under
16:49Nazarov's name. They drive to the
16:52Hollywood Casino in Maryland Heights.
16:54On the outskirts of Saint Louis, Deron
16:57Harris, the Hollywood Casino
16:59surveillance director, received the FBI
17:01alert 48 hours earlier. He has Bliev's
17:05photo on his desk. At 9:14 p.m. on
17:08December 10, Murat Bliev sits down at
17:11an Aristocrat Mark VI machine. He takes
17:14out the prepaid phone. At 9:19 p.m.,
17:17three FBI agents and two security
17:19guards surround him. Bliev puts the
17:22phone away and stands up in silence.
17:25The four are taken to the FBI federal
17:28headquarters in Saint Louis. That same
17:31night, investigators access Gudalov and
17:34Lavrenov's phones. On both, they find
17:37the application: a blank screen that
17:39vibrates at scheduled times with no
17:41identifying icon. No text, just a pulse
17:45. On March 19, 2015, the federal grand
17:48jury for the Eastern District of
17:50Missouri issues the formal indictment.
17:54Four defendants, four counts of travel
17:56in interstate commerce in furtherance
17:58of a conspiracy to commit fraud.
18:01Maximum per charge: 5 years in federal
18:04prison and a $ 250,000 fine. Gudalov,
18:08Lavrenov, and Bliev are Russian
18:10citizens. Russia and the United States
18:13have no extradition treaty, but they
18:15are on American soil and surrendered
18:18quietly. 16,000 km away in Saint
18:21Petersburg, Alex reads the Department
18:23of Justice statement on his screen. No
18:27one is going to arrest him. His agents
18:29take the risk. He designed the system
18:32that way from the beginning, only now
18:34there is a journalist following his
18:36trail. In February 2017, Brendan
18:39Koerner publishes the full report in
18:42Wired on the Lumiere Place incident and
18:44its connection to a group in Saint
18:46Petersburg. Two sources cite the name
18:49Alex Pila as the architect of the
18:52system. Two weeks after publication,
18:55Alex writes an email, introducing
18:58himself. He says he’s read the
19:01article and would like to talk. The
19:03interview lasts for weeks of encrypted
19:05exchanges. Alex explains he’s been at
19:08this for nine years, that he’s
19:10cracked the PRNGs of over 12 slot
19:12machine models from four different
19:14manufacturers, that his teams have
19:16operated in Poland, Macau, Peru,
19:18Singapore, and various Eastern European
19:20countries he won’t name, and that
19:22he’s thinking of retiring but can't
19:25simply shut down something that
19:26operates in gray areas. His only assets
19:30are the algorithms in his head and the
19:33agents who know the app but don’t
19:35know who designed it, and he has a
19:37proposal for Aristocrat. In November
19:402016, Alex had sent an email to Trace
19:43Elkerton, global director of regulatory
19:46compliance at Aristocrat. Subject:
19:49eliminating design flaws in your
19:51products. He offered to show the
19:54Mark’s vulnerability with
19:55mathematical precision. He would
19:59cooperate to fix it, and in exchange,
20:00his agents would stop operating on
20:02Aristocrat machines. He added that if
20:05he didn't receive a response, he was
20:07prepared to publish the technical
20:09details of the vulnerability in public
20:11forums and share them with
20:12Aristocrat’s competitors. Elkerton
20:15agreed to a conference call. She
20:17recorded it. Alex recorded it, too. On
20:21the call, Alex explained the
20:22vulnerability with a technical
20:24precision that the Aristocrat engineers
20:26present couldn't refute. He sent
20:30written mathematical evidence, some
20:32containing deliberate errors, inside
20:35code jokes to see if the Aristocrat
20:37engineers were capable of detecting
20:39them. They did not detect them.
20:42Elkerton replied that she appreciated
20:44the information, but that Aristocrat
20:46could not negotiate without guarantees
20:47that he would hold up his end. She
20:51proposed meeting on neutral ground in
20:52the United States. Alex was in Russia.
20:56He proposed staying in Russia.
20:58Aristocrat didn't pay. Alex didn't shut
21:01down the operation. In 2016, two
21:03operatives were arrested in Singapore.
21:07Sentences of 16 and 14 months in prison
21:10. Neither revealed information about
21:13the core structure during
21:14interrogations. Murat Bliev pleaded
21:16guilty to one count of conspiracy to
21:19commit fraud. Sentence: 2 years of
21:22supervised probation. Deported to
21:25Russia at the conclusion of the process
21:27. Igor Labrenov and Ivan Gudalov
21:29received similar sentences, and Evgeni
21:32Nazarov, an American citizen, signed a
21:34cooperation agreement with the
21:36prosecution. The terms are not public.
21:40The total damage does not appear in any
21:42court document. Missouri prosecutors
21:45didn't cite a global figure because
21:47they didn't have access to the St.
21:49Petersburg records. Estimates from the
21:52casino security industry, Willy Allison
21:55, and the consulting firm Global Gaming
21:58Consultants place the total volume of
22:00the operation between 2008 and 2017 in
22:03a range of 16 to 20 million dollars,
22:05likely more, just in the 43 documented
22:08casinos in the United States between
22:112011 and 2014. More than 4 million.
22:15Aristocrat updated the firmware of its
22:18Mark VI in 2015. New models use PRNGs
22:22with 128-bit states and additional
22:25encryption with keys that rotate every
22:286 hours. Novomatic had updated theirs
22:31in 2013. Machines manufactured before
22:352009, those Alex bought during the
22:37closure of Russian casinos and studied
22:39for months, remain in circulation. More
22:43than 40,000 units are active in
22:45secondary markets in Latin America, the
22:47Caribbean, and Southeast Asia. Most
22:50with the original firmware. Alex was
22:53never charged with any crime under
22:55Russian law. In 2009, when the
22:58operation reached an international
23:00scale, PRNG prediction activities were
23:02not criminalized in the Russian Penal
23:04Code. No Russian prosecutor initiated
23:08any proceedings. Alex remains in Russia
23:11. A machine cannot lie, but the law can
23:14look the other way for long enough. In
23:172026, there are approximately 100,000
23:20Aristocrat Mark VI machines in casinos
23:23around the world. They use the 2015
23:26firmware. The vulnerability Alex found
23:29has been patched for 11 years. In his
23:32last communication with Brendan Koerner
23:35, in 2017, Alex said he was studying
23:37the PRNGs of a new generation of
23:40machines. From a company whose name he
23:43refused to reveal. What Alex built was
23:45a company with structure, with field
23:47operatives on three continents, with a
23:50chain of command, with a technical
23:52product that required years of
23:54development. His agents went to jail.
23:57He received an interview in Wired. The
23:59gaming industry insisted for 9 years
24:02that their machines were inviolable.
24:05Aristocrat told the FBI that the Mark
24:07VI could not be manipulated in this way
24:10. Novomatic took 3 years to issue an
24:13internal warning. 43 American casinos
24:17lost money for 3 years without knowing
24:20it was the same system draining them
24:23one by one at $ 40 per vibration. The
24:26man who uncovered the American pattern
24:29was not from the FBI; he was a casino
24:31surveillance director in Louisiana who
24:34checked hotel records in his spare time
24:36. Marcus Combs, the security director
24:40at Lumiere Place, who called the FBI in
24:43June 2014, stated in 2017 that the
24:45question he cannot answer is how long
24:48this had been going on before the
24:50numbers became weird enough for someone
24:53to bother looking at them. On June 2,
24:572014, at 8:19 PM, Murat Blieff sent a
25:00video of 24 spins from inside a casino
25:04in St. Louis to an office in St.
25:06Petersburg. 32 minutes later, his phone
25:10vibrated. He waited 0.25 seconds. He
25:14pressed the button. The machine could
25:16not lie. It did exactly what the code
25:19told it to do. The code, however, was
25:21written by someone whom no one has
25:23managed to take to court yet. Yeah.

About this transcript

This page contains the full transcript of Cómo un Ruso Robó $20 Millones a Casinos by VEGAS español, generated from the public captions YouTube serves with the video. The transcript has 3,467 words across 553 segments, with the original timestamps preserved so you can click any line to jump to that moment in the embedded player.

What you can do with it

Use the transcript to take notes, quote the speaker, build a study guide, generate a summary with ChatGPT or Claude via the YouTube Summary tool, or export it as a timed subtitle file with YouTube to SRT. You can also re-open it in the transcriber to translate the transcript into 100+ languages.

Free YouTube transcript tool

YouTube2Text is a free YouTube transcript generator — no signup, no daily limit. Paste any YouTube link and get the full transcript instantly, with timestamps, click-to-jump, translation to 100+ languages, AI prompts for ChatGPT, Claude, and Gemini, and exports to TXT, SRT, VTT, or Markdown.