Crypto casinos explained: provably fair, legality and the risks

What a crypto casino is

A crypto casino is an online casino that takes real-money bets directly in cryptocurrency, such as bitcoin, ether or stablecoins, rather than in dollars or through a bank. Unlike a US sweepstakes casino, it does not wrap itself in a promotional structure; it is straightforwardly a gambling site, just one denominated in crypto. The best-known example, Stake.com, is a large international operator run under a license from Curacao.

That offshore licensing is the norm. Most crypto casinos hold a permit from a lightly resourced jurisdiction such as Curacao or Anjouan, regulators with limited ability to enforce rules beyond their own borders. The license gives a site an official-looking stamp, but it does not connect the operator to any US state's consumer-protection regime, which is central to understanding both the legality question and the risks.

What provably fair actually means

The signature feature crypto casinos advertise is 'provably fair,' a cryptographic method that lets a player verify a bet's outcome was fixed before the bet was placed and was not tampered with afterward. It rests on three inputs. Before a round, the site generates a secret server seed and publishes a cryptographic hash of it, which acts as a sealed commitment. The player supplies or can change a client seed, and a nonce, a simple counter, increments with each round so the same seed pair never produces the same result twice.

As European Gaming describes it, the platform combines these inputs using a hashing algorithm, commonly HMAC-SHA256, where the server seed acts as the key and the client seed and nonce form the message. The output determines the game result. After play, the site reveals the original server seed. A player can then re-hash it and confirm it matches the commitment published earlier, and re-run the seeds and nonce to confirm the result was the one the math produced. Matching values show the outcome was not swapped after the bet.

Two features give the method its teeth. First, the published hash is a one-way commitment: because a cryptographic hash cannot feasibly be reversed, the operator cannot change the server seed after seeing the client seed and nonce without breaking the match a player will later check. Second, the player can rotate their own client seed at any time, which stops the house from pre-computing results aimed at a specific account. Together those constraints rule out one particular kind of cheating, spin by spin.

What it does not prove

Provably fair is genuinely useful, but its scope is narrow and often oversold. It proves that a specific result was generated from committed inputs and not altered after the fact. It does not prove that the game's house edge is reasonable, that the odds are set fairly in the first place, or that the operator holds enough funds to pay winners. A game can be perfectly provably fair and still carry a punishing built-in margin.

It also assumes the player does the work. Verification requires running the revealed seeds through a hashing tool and comparing outputs, which very few players actually do. And it says nothing about the parts of the business that tend to hurt people: whether withdrawals are processed, whether accounts are frozen, or whether the company is solvent. In short, provably fair addresses cheating on a single spin, not the trustworthiness of the platform as a whole.

Legality and enforcement in the US

For US players, the headline is simple: these sites are not licensed to take their bets. Offshore crypto casinos operate outside every US state's gaming regime, and accepting real-money wagers from US residents without a state license is illegal. Stake.com itself does not accept US customers, which is why a separate US-only sweepstakes product exists under a related brand. Players who reach offshore sites through a VPN are breaking the operator's own terms and give up any consumer recourse if something goes wrong.

State regulators have been active against offshore operators. The Michigan Gaming Control Board issued cease-and-desist letters to 12 offshore gambling operators on 3 December 2025, and Arizona's Department of Gaming ordered seven sites, including Stake.us, to stop on 30 June 2025. These letters do not physically block a determined user, but they establish that the activity is unlawful in the state and put pressure on the payment and marketing partners the sites rely on.

The pattern across states is consistent. Whether the target is an offshore crypto casino or a crypto-facing sweepstakes brand, regulators in Michigan, Arizona and Illinois have treated the activity as illegal gambling and aimed their orders at the operators and their partners rather than at individual users. For a US player, that consistency is the practical signal: the sites may remain reachable, but the legal system has already decided what they are.

The risks, and our take

The core risk of an offshore crypto casino is the absence of anyone a US player can turn to. There is no state regulator to hear a complaint, no mandated self-exclusion, and no guarantee that identity checks or anti-money-laundering controls are meaningful. Crypto deposits are irreversible, so a compromised account or a refused withdrawal often means the money is simply gone. Price volatility can also change the real value of a balance between winning and cashing out.

The security risk is not hypothetical. The FBI attributed the theft of roughly $41 million in cryptocurrency from Stake.com around 4 September 2023 to North Korea's Lazarus Group, a reminder that even the largest crypto casinos are high-value targets. Our take is that provably fair is a real but limited assurance that solves a narrow problem while marketing implies it solves a broad one. For US players, the legal status, the lack of recourse and the security exposure matter far more than whether a single dice roll can be mathematically verified.