New reports of this keep rolling into my Twitter DMs every day, and all of them seem credible.

All of them involve amounts $9k-$20k, with the exception of one bizarre situation where a guy deposited $247 and it was promptly withdrawn and stolen. (Oddly they didn't touch the original $68 he had in the account prior to the deposit.)

All of them have very similar circumstances -- no password change, no breach in e-mail, and no sign anything's wrong. Suddenly a withdrawal is made via bitcoin, and they're out the money.

In some cases, a refund was made. In others, no refund was done yet, but the process of investigation tends to take 2-3 weeks, from what I've seen.

No explanation is ever given when the money is refunded. ACR refuses to give anyone the IP address or bitcoin address of the person making the fraudulent withdrawals. They just ignore these requests.

Very high chance at this point that an insider is doing this. I don't believe management is in on it, but I know 100% they're aware of it, as I had the message passed to Nagy himself that this is going on.

It is highly suspicious that ACR is both refunding these large amounts to some people (why would they if it's the players' fault), as well as the fact that ACR will not provide the IP/bitcoin address info. I think they're trying to internally stop this before the story gets out.

The earliest known instance of this was on January 26th. The latest known incident was April 3.