Bot economics · 13 min read · Updated 28 May 2026
Who pays for a ClubGG bot
A working ClubGG bot is not a thing you buy off a shelf and point at a lobby. It is commissioned to farm one club, its return is the rakeback deal behind that club, and the person who placed it is usually an insider — an agent or owner, not a stranger. To understand the bot you have to understand the deal it serves. The engineering is the easy part.
Summary
- A ClubGG bot has no global market value because there is no global pool. Its return is the rakeback economics of one specific club, so the same software is worth a lot in one club and nothing in another.
- The buyer is usually an insider. The agent or owner who controls a club is best placed to embed a bot in it, hide it from the network layer, and bank the result through his own settlement — which is why most real club bots are inside jobs, not freelancers.
- Server-side exploits, Diamond minting, RNG prediction and hole-card peeks are all architecturally closed — ClubGG sits on NSUS infrastructure shared with the regulated GGPoker operator. The only category with real engineering is decision-support AI playing visible state.
- Almost nothing real is sold to retail buyers on Telegram. Working bots stay inside the clubs that commissioned them; the public listings are repackaged solvers, credential-stealers or remote-access malware aimed at the player who thinks he can buy an edge.
A bot is only worth its club's deal
Start with the money, because the money explains the software. On a public site a bot's value is roughly the same everywhere — it joins the global pool, beats the average opponent and grinds rake-adjusted EV. On ClubGG there is no global pool. A bot only ever plays inside the clubs it is admitted to, against those clubs' regulars, paying those clubs' rake, and cashing out through those clubs' settlement. Its return is not a property of the software. It is a property of the deal.
Concretely, the same engine that nets a steady profit in a soft club with generous rakeback and inattentive regulars is a money-loser in a club one tier up — tougher players, worse rakeback, an owner who watches. Move it to a third club where the owner takes a cut to look the other way and the math changes again. The bot has not changed; the deal has. This is why you cannot price a ClubGG bot the way you would price a public-site bot, and why the "buy a bot, point it anywhere" pitch is incoherent before you even open the binary.
It also explains who actually commissions them. The person best positioned to make a bot profitable is the one who controls a club's deal — an agent or owner who can seat it quietly, suppress club-side scrutiny, set a rake that favours it, and settle the winnings without questions. A stranger buying software off Telegram has none of that. So the real bot economy on ClubGG runs through insiders farming their own players, and the retail "hack" market is a separate, mostly fraudulent thing layered on top. Hold that distinction and the rest of the page reads cleanly.
The retail "hack" market, sorted honestly
The public side of all this is the flood of "ClubGG hack" listings aimed at players. Collapsing them into one thing is the mistake; they split into five claims, each with a different feasibility profile. Four are fantasy sold to the magical-thinking buyer. One is real, and even that one is rarely what is actually being sold.
| Category | What it claims | Required capability | Feasibility |
|---|---|---|---|
| Server exploit | Read cards from NSUS infrastructure | Remote code execution on shared servers | Practically no — value goes to a bug bounty, not a Telegram listing |
| Diamond infusion | Mint or duplicate Diamonds | Write access to the balance ledger | No — balances are server-authoritative and reconciled to agent logs |
| RNG break | Predict the next board card | Recover CSPRNG state from outputs | No — modern CSPRNGs are not invertible at the rate poker exposes |
| Hole-card peek | See opponent cards live | Operator privilege or client decryption | No — same server-authoritative model as GGPoker |
| AI decision engine | Better play given visible state | Solver outputs + opponent model + UI automation | Yes — the only category with real engineering |
Four of the five are architecturally closed or economically nonsensical for a product sold publicly. The fifth is where the engineering is, and is what most "hack" listings really are once the marketing language is stripped away.
Why NSUS infrastructure closes server-side exploits
ClubGG runs on shared infrastructure with the rest of the NSUS Group estate, including GGPoker, a regulated public operator carrying gambling licences in jurisdictions like Malta. The security posture required to keep those licences propagates down to the shared infrastructure layer — TLS termination, application-layer encryption, server-authoritative card generation and audit-friendly logging do not get switched off for the club-app product.
The client is a display layer. Card information for a seat is produced server-side and sent only to clients with the right to see it; opponent hole cards are never transmitted to a client until showdown. A working remote code execution against NSUS infrastructure would be worth six or seven figures through coordinated disclosure, with serious jail-time exposure. That payoff structure does not flow through a Telegram channel selling a $200 download. The UltimateBet 2007 and Absolute Poker 2008 cases were insider exploits by privileged staff, not external attacks resold to retail buyers.
The Diamond infusion myth
Unique to club apps and the most commonly sold variant on Telegram. The claim fails at the first architectural step: Diamond balances are not stored client-side. The client displays the balance the server reports; if the client lies, the next server action — joining a table, transferring Diamonds, paying rake — fails to validate and the discrepancy gets reconciled to the server's view.
The deeper reason is club-side reconciliation. Diamond movement is logged for the club operator, who sees transfer histories for every player. A balance that increased without a matching agent transfer triggers a question. Even if the platform ledger could be tricked, the club operator's books would not match, and the discrepancy is visible at the next settlement. Software sold as a "Diamond hack" is almost always a rebranded bot, a phishing page that captures credentials, or a remote-access trojan that drains whatever wallet is on the buyer's phone.
Why RNG prediction does not work
Modern shuffling on ClubGG, GGPoker and every serious operator uses a cryptographically secure PRNG seeded from multiple entropy sources, with the deck committed server-side before any card reaches a client. The information-theoretic argument settles the rest: the data rate exposed by poker — roughly fifty bits of card information per hand at a few hundred hands per hour — is many orders of magnitude below the bandwidth a CSPRNG produces internally. You cannot reconstruct internal state from a heavily filtered, attenuated output. The iPoker 2013 incident was an implementation bug fixed within weeks, with no equivalent on any current operator.
The one real thing, and who it is built for
The only category with genuine engineering is decision-support AI — software that plays visible game state well. It is real, it works, and almost nobody selling it on Telegram has it, because the people who do have it are using it inside their own clubs rather than licensing their edge to strangers. The architecture mirrors a GGPoker bot with three club-specific differences, and each difference points back at the deal it serves.
- Solver-anchored baseline
- Pre-computed strategies from CFR-family solvers — PioSolver or GTO+ for heads-up and 6-max trees, MonkerSolver for multiway and PLO. Pluribus (Brown and Sandholm, 2019, Science) is the reference for superhuman 6-max NLH; DeepStack (Moravčík et al., 2017) for heads-up. The engineering problem is compressing solver output to a runtime-queryable form inside a mobile inference budget.
- Online opponent model under stable club identities
- Club tables have the same regulars across sessions, which removes the anonymous-rotation problem that dominates GGPoker bot work — long-horizon, per-opponent modelling becomes feasible again. The bot can profile each regular: play softer against the fish the owner wants kept happy, tougher against the visiting reg. The cost is symmetry — the owner is watching those same regulars and can flag the bot by ordinary observation. The edge and the exposure both come from everyone knowing everyone, which is why the insider who controls the club is the natural operator.
- UI automation on Android-class hardware
- ClubGG is mobile-first. The automation surface is accessibility-service-driven on Android. The visible client changes every few weeks as the operator pushes updates, and the screen-scrape or accessibility-tree layer is the most fragile part of the pipeline. iOS is harder; the alternatives are unstable across OS versions.
None of this is magic. It is software competing in a game, not breaking a game, and its value is still capped by the deal behind the club it plays in. A flawless engine in a club with thin rakeback and tough regulars barely clears the rake; the same engine in a soft, generously-staked club run by a complicit owner prints. The code is necessary but never sufficient. The deal decides.
Where the deal makes a bot pay
The viable zone is defined by club economics, not stake level. Small-and-mid clubs at USD-equivalent $0.10/0.25 to $1/2 6-max are the sweet spot, but not because the cards are easier — because that is where the conditions line up: exploitable regulars, an inattentive owner, and rake structures that compete for grinders by giving back more than a public operator would. Move up a tier and all three reverse — vetted players, attentive ownership, small samples — and the same bot stops paying regardless of how good it is. High-stakes club games are effectively closed for this reason, not a technical one. A pure-heuristic bot without solver compute loses to mid-stakes regulars over volume, so the floor is solver-anchored even at micro; but above the floor, the limiting factor is always the rakeback math and the owner's posture, not the engine.
Why the retail scam outlives every real bot
One piece of governance reaches across the whole NSUS estate: because ClubGG and GGPoker share ownership, any signal you generate on either should be assumed observable to the other — device fingerprints, payment methods and KYC documents overlap into a plausible shared abuse-graph. That raises the cost of being a clumsy outsider and pushes real bot operations further inside the clubs that can shield them, reinforcing the insider pattern.
Meanwhile the retail "hack" market thrives on exactly the opposite person — the outsider with no club, no deal and no shield, who imagines he can buy what insiders build. Three forces keep it alive. Buyers self-select for magical thinking, hoping for a one-button win instead of study. Sellers have near-zero costs in 2026: an LLM writes the landing copy, stock testimonials fill the social-proof slot, Telegram automation handles distribution. And the club-app structure multiplies the funnel — one scam shell is reskinned for ClubGG, PPPoker, PokerBros, X-Poker and the regional Asian apps, swapping only the logo and screenshots. A two-percent conversion on cheap traffic at a hundred-and-fifty-dollar order funds the operation forever, with no obligation to deliver anything that works. The real bots stay invisible because they belong to clubs; the visible ones are bait, because bait is the only ClubGG product an outsider can actually sell.
Talk to the team
Questions on club-level bot economics, per-opponent modelling under stable identities, why insiders rather than buyers run the real bots, or anything else in this piece — the chat is read by the Poker Bot AI team.