SportPesa is facing a deepening trust crisis on two fronts at once. Fresh complaints are emerging from bettors who say they were unable to cash out winnings on the platform’s crash game, while a separate claim by a cybersecurity threat actor alleges that administrative access linked to SportPesa’s jackpot infrastructure was compromised through a third-party tip aggregator known as Tips Hub. Neither allegation has been independently confirmed by SportPesa. But taken together, the claims are raising uncomfortable questions about the company’s systems—and about how seriously it responds when the very customers funding its business say something has gone badly wrong.
A complaint now circulating details a bettor’s account of what she described as interference with her winnings on SportPesa’s betting platform, a case she said she was pursuing with both the company and the Gambling Regulatory Authority, the body responsible for overseeing Kenya’s betting industry. The bettor, identified in the complaint as Esther Musimbi, said she had been playing a crash-style game on SportPesa several days earlier, the fast-paced format popularised by titles such as Aviator, where a multiplier rises in real time and players must cash out before the round crashes to secure their winnings. According to her account, placing bets worked normally. The problem began when she tried to collect her winnings. Her cashout attempts were either blocked outright or failed to execute when she needed them to work.
Musimbi said the malfunction cost her multiple winnings. After the first incident, she began recording her subsequent sessions specifically to capture evidence of what was happening, and forwarded the footage to SportPesa. Her account then describes a corporate response that will sound painfully familiar to many frustrated customers: SportPesa acknowledged the complaint, told her it had been escalated internally and then, according to her, went silent. With the company’s own channels apparently exhausted, she turned to the Gambling Regulatory Authority, the successor to the former Betting Control and Licensing Board, only to find what she described as another dead end, with emails going unanswered. She also attempted to call the authority using legacy BCLB contact numbers, assuming that only the institution’s name had changed. Those calls, too, went unanswered. Her complaint ultimately asks whether there is a specific official she can escalate the matter to, or whether she must turn to consumer protection bodies instead—a question that exposes just how difficult Kenya’s gambling oversight system can be for an ordinary bettor demanding answers.
A cashout failure on a crash game is no ordinary technical glitch. The entire premise of Aviator-style games rests on a player’s ability to issue a cashout instruction at a precise moment before the multiplier collapses. The platform must therefore execute that instruction reliably and immediately. When a cashout request fails or is blocked at the exact moment a bettor is attempting to secure a winning position, the result for the customer is effectively the same as losing money on a bet that had already become a win. Musimbi’s decision to record her sessions is revealing. It reflects the reality that a bettor facing a dispute with a betting platform can have little leverage without independent evidence of what happened. Without recordings or other documentation, the platform’s backend account of the transaction may become the only version of events that counts.
This is not the only storm gathering around SportPesa. The cashout complaint comes days after a cybersecurity threat actor claimed to have compromised the administrator account of Tips Hub, a tip aggregation platform whose alleged breach is said to expose data connected to SportPesa alongside several other Kenyan betting operators. Among the material the threat actor claims to have obtained, one of the most alarming items for SportPesa users is the alleged exposure of SportPesa Mega codes—identifiers associated with the platform’s flagship jackpot product and one of the most aggressively marketed features for Kenyan bettors chasing a potentially life-changing payday. Jackpot codes are not harmless pieces of information. They are tied to the process through which winnings are verified and claimed. If such codes were genuinely exposed to an unauthorised party, the integrity of the entire jackpot payout process could come under scrutiny.
Alongside the alleged Mega codes, the threat actor claims the compromised environment contains account balance data exceeding KES 142,000, internal betting tips and market selections distributed through channels linked to SportPesa, internal messages associated with those channels, and stored message identifiers that could allow communications to be traced or reconstructed. More seriously, the actor claims the compromised account possesses administrative powers capable of sending, updating and deleting messages within the platform, including channels through which jackpot codes and betting tips are distributed. That would go far beyond simple access to stored information. It would amount to access to the communication pipeline SportPesa bettors rely on, creating the possibility—if the claim were authentic—of fabricated Mega codes, false jackpot results or manipulated market selections being pushed through channels carrying SportPesa’s credibility. As alleged evidence, the threat actor published what appears to be a screenshot of the Tips Hub administrative dashboard. Analysts monitoring the disclosure have not independently authenticated the screenshot and have not established whether SportPesa itself was directly infiltrated, as opposed to a third-party service that interacts with its platform.
Read together, the crash-game cashout complaint and the alleged Tips Hub breach expose the same fundamental problem from two different angles: trust. One account describes a payout mechanism apparently failing when a customer attempts to collect a win, followed by an escalation process that leads nowhere. The other describes an alleged breach reaching into the administrative layer responsible for jackpot codes and tip distribution, with SportPesa yet to confirm whether its own systems were compromised. Whether the two incidents are connected or completely unrelated, the ordinary bettor is left staring at the same uncomfortable question: when money disappears or a jackpot code suddenly becomes questionable, how can a customer know whether it was bad luck, a technical failure, a security breach—or something far more troubling?
SportPesa’s exposure to these claims also cannot be separated from the company’s wider financial pressures. The Kenya Revenue Authority has pursued a Sh1 billion bid to freeze financial accounts linked to SportPesa’s parent company, Milestone Games, in a tax dispute that remains active and unresolved. A company battling over a billion shillings in frozen accounts is operating under significant financial and reputational pressure. That does not prove wrongdoing in either the cashout complaint or the cybersecurity allegations. But it adds another layer of scrutiny to a company now facing questions over customer payouts, security and transparency.
The tax battle is unfolding alongside a dramatic reshaping of who owns SportPesa. Milestone Games’ shareholding has shifted heavily toward foreign firms, with the UAE-linked company Techglow Ltd taking a 54 percent stake and Commtech Consortium Ltd taking 25 percent, diluting the Kenyan founders who built the SportPesa brand. Founder Ronald Karauri’s stake has reportedly fallen from a combined 54.4 and 13.4 percent to just 3 percent, while co-founder Robert Macharia’s stake has dropped from 71 percent to 0.75 percent. Ownership of a platform processing hundreds of billions of shillings in annual stakes has, in other words, moved decisively away from the people who built it and toward foreign holding structures that are now expected to answer for everything from a bettor’s blocked cashout to an alleged breach of administrative access.
The Commtech Consortium stake in SportPesa is not an isolated financial footnote. Commtech has, at various points, also held a parallel stake—since transferred to an entity called Starway Trading Ltd—in Konvergenz, the technology firm behind the Social Health Authority’s digital platform, a Sh104.8 billion government health system. That overlapping ownership between a company holding a quarter of SportPesa and a company tied to one of Kenya’s largest and most politically sensitive digital government contracts has already attracted scrutiny in previous reporting, including a public dispute between former Deputy President Rigathi Gachagua and Cabinet Secretary Aden Duale over a stake in the Konvergenz entity. None of that ownership web directly proves the cashout complaint or the Tips Hub allegation. But it makes one thing clear: SportPesa is no longer simply a betting brand operating in isolation. It sits inside a far wider and more politically entangled financial structure, meaning any serious failure involving payouts or security can carry consequences far beyond a single punter and a single betting slip.
Musimbi’s experience with the Gambling Regulatory Authority may be the most troubling part of the story because it illustrates precisely how complaints can fall into a black hole. The authority’s Director General, Peter Karimi, has faced scrutiny over alleged conflicts of interest, raising questions about how effectively the regulator can supervise the very companies it is mandated to police, SportPesa included. For a bettor whose cashout has failed, an unanswered phone call and an ignored email offer little comfort. For users worried about whether jackpot codes were exposed, the absence of a responsive regulator is even more serious. From the bettor’s perspective, an oversight system that cannot answer when people need it is barely an oversight system at all. Kenyan bettors are being asked to trust a regulatory architecture that has struggled to demonstrate it can enforce the standards it demands from the industry—at exactly the moment SportPesa’s ownership, payout systems and administrative security are all facing heightened scrutiny.
SportPesa’s turbulent relationship with Kenyan regulators and its own public commitments provides further context for why these allegations cannot simply be brushed aside. The company withdrew from all sponsorships in Kenya in 2019 following a bitter dispute with authorities over betting taxes, a confrontation that left top-flight football clubs scrambling for alternative funding and demonstrated how quickly SportPesa’s corporate decisions could reverberate across institutions far beyond its own platform. The company later returned to the Kenyan market, but tensions with Kenyan tax authorities never fully disappeared and have resurfaced in the current Sh1 billion KRA account-freeze dispute. That history matters. It shows a company that has previously responded to financial and regulatory pressure with dramatic moves, from abandoning sponsorships to restructuring its ownership around foreign shareholders. Against that backdrop, a crash-game malfunction allegedly followed by silence, combined with a claimed security breach involving jackpot codes and administrative messaging, raises a much bigger question about transparency: will SportPesa confront these issues openly, or will they once again be managed behind closed doors until the pressure becomes impossible to ignore?
Until SportPesa makes a clear public statement addressing both the emerging cashout complaints and the alleged Tips Hub breach, bettors should treat any Mega code, betting tip or promotional message arriving through channels linked to Tips Hub with caution. They should also consider independently recording crash-game sessions whenever significant sums are at stake, as Musimbi did, particularly given the apparent lack of a dependable escalation route through either SportPesa’s customer service or the Gambling Regulatory Authority. Bettors who experience similar cashout failures should document the incident immediately, preserve screen recordings where possible and pursue complaints through recognised consumer-protection channels alongside SportPesa rather than relying solely on the company’s internal escalation process. With Sh330.5 billion in stakes now flowing through Kenya’s betting industry annually, even a relatively small percentage of cashout failures or jackpot-related fraud arising from either problem could translate into losses worth tens of millions of shillings across SportPesa’s user base. And if the regulator remains silent when bettors demand answers, the people carrying the financial risk may once again be the very people with the least power to demand accountability.
