The Outlier Lab

Case Study - DraftKings Credential Stuffing (2022)

A November 2022 credential stuffing wave hit roughly 60,000 DraftKings accounts; attackers added their own payment methods to about 1,600 and withdrew around $600,000.

What happened

  • Entry. No DraftKings systems were reported breached. The attackers used credentials leaked elsewhere and relied on customers reusing passwords, which is classic Credential Stuffing. DraftKings first estimated losses under $300,000. Its later customer notification put the number of affected accounts at 67,995.
  • Monetization path 1: direct cash-out. In the accounts with balances, the attackers attached a payment method they controlled and withdrew the funds to it. This is Payout Redirection inside a stored-value wallet. Prosecutors put the direct theft at about $600,000 across roughly 1,600 accounts.
  • Monetization path 2: resale. Access to compromised accounts was also sold through online shops, including one shop a defendant ran himself. This is the Account Farming and Resale and division-of-labor pattern: one group cracks accounts and other buyers cash them out. The DOJ did not disclose how much the sales brought in.
  • Why gaming wallets are attractive. A betting balance behaves like a lightly controlled stored-value account. It holds withdrawable cash and is often linked to cards and bank accounts. Customers check it less often than a bank account. A login is the only gate before value moves. The same economics apply to brokerage cash balances, cashback balances and neobank wallets.
Diagram: Breached credentials from other sites, Automated login attempts, Valid logins (~60K accounts), New payment method added, Balance withdrawn (~1,600 accounts), Account access sold to other buyers

Timeline

DateEvent
On or about November 18, 2022Credential stuffing attack begins, per SDNY. DraftKings' president publicly puts losses at up to about $300K and says customers will be made whole.
December 2022DraftKings notification (filed with the Maine AG) puts affected individuals at 67,995 and says withdrawn amounts were restored for affected accounts
February 2023Search of Garrison's home finds stuffing tooling and about 40 million credential pairs (per SDNY)
May 2023Joseph Garrison of Madison, Wisconsin, charged in SDNY
November 15, 2023Garrison pleads guilty to conspiracy to commit computer intrusion
January 29, 2024Nathan Austad ("Snoopy") and Kamerin Stokes ("TheMFNPlug") arrested on a six-count complaint, including wire fraud and aggravated identity theft
January 31, 2024Garrison (19) sentenced to 18 months, 3 years supervised release, $1,327,061 restitution, $175,019 forfeiture
April 25, 2024Stokes pleads guilty to conspiracy to commit computer intrusion. He later reopened his account shop while on pretrial release and was rearrested.
December 12, 2025Austad pleads guilty to conspiracy to commit computer intrusion
April 16, 2026Stokes sentenced to 30 months, 3 years supervised release, $1,327,061 restitution, $125,966 forfeiture
June 23, 2026Austad sentenced to 18 months, 3 years supervised release, $1,327,061 restitution, $463,684 forfeiture. Crypto accounts he controlled had received about $465K.

Mechanisms involved

Control gaps

GapWhy it mattered
Password-only login on funded accountsCredential reuse turned into account control (Multi-Factor Authentication (MFA), Passkeys and Phishing-Resistant Authentication)
No (or weak) breached-credential screeningCredentials already circulating from other breaches were accepted (Breached Password Detection)
Login volume not throttledTens of thousands of successful logins in a short window (Bot Management and CAPTCHA, Rate Limiting and Throttling)
New payout instrument trusted immediatelyAdding a payment method and withdrawing right away was enough to cash out (Contact Change Cooling-Off Periods, Withdrawal and Payout Controls)
No step-up at the money movementWithdrawal didn't require reauthentication after a risky login or account change (Risk-Based Authentication and Step-Up)

Detection and response

Public reporting shows DraftKings detected the wave and disclosed it within days. Its president said publicly that DraftKings' own systems were not breached, that the company would replace customers' lost funds, and urged customers to use unique passwords. Customers were prompted to reset passwords once the incident was identified. The December 2022 notification letter said the company had restored amounts withdrawn from affected accounts, and listed the exposed data: names, contact details, account balances, last four card digits, transaction history and the date of the last password change. Some customers complained publicly that attackers had changed their passwords and enrolled 2FA to a phone number they didn't recognize, a lock-out move that delays victim discovery.

The affected-account count grew from the first public statement to the formal notification. That is typical, because the first count reflects confirmed cash-outs and the full number of valid logins only emerges after log review. Per SDNY, in some accounts the attackers verified the newly added payment method with a small $5 deposit before withdrawing, so a tiny deposit followed by a full withdrawal to a new instrument is the money-path signature. The criminal case moved quickly by cybercrime standards. The first defendant was charged about six months after the attack, and investigators linked defendants through crypto accounts and the account-resale shops.

Outcome

  • Criminal: three guilty pleas in SDNY, each to one count of conspiracy to commit computer intrusion. Sentences were 18 months (Garrison), 30 months (Stokes) and 18 months (Austad), each with three years of supervised release.
  • Financial: about $600K withdrawn directly from about 1,600 accounts. Each defendant was ordered to pay the same $1,327,061 in restitution, which suggests the measured loss (including the operator's remediation) went beyond direct withdrawals. Forfeitures were about $175K (Garrison), $126K (Stokes) and $464K (Austad).
  • Customers: DraftKings said it restored withdrawn amounts to affected accounts.
  • Civil and regulatory: none found as of October 2026.

Lessons for practitioners

  1. Measure the gap between valid logins and losses. Here roughly 60,000 accounts were accessed but only about 1,600 were cashed out directly. The rest are a second-wave risk: resold access, stored payment data, later drain. Count every account with a suspicious successful login as exposure, including those without losses (Fraud Metrics and KPIs).
  2. Put the hard control at the payout change. You can't stop all stuffing at login. You can make "new payout instrument followed by withdrawal" expensive with cooling-off periods, step-up and holds scaled to risk. See Account Change Events, Payment Instrument Signals and Playbook - Payout and Withdrawal Risk Members.
  3. Watch the success rate as well as the volume. A stuffing wave shows up as low login success rates from rotating infrastructure. The dangerous slice is the valid logins that follow. Correlate Login Anomalies, Automation and Headless Browser Signals and IP Reputation and Proxy Detection, and alert on spikes in post-login account changes (Velocity Signals).
  4. Expect resale as well as theft. When access is sold on, losses keep arriving for weeks from different infrastructure and behavior. Force resets and revoke sessions on every account with a suspect login, including ones that weren't drained (Playbook - Credential Stuffing Response Members).
  5. Any stored-value balance is a target. Betting wallets, brokerage cash, cashback balances and neobank accounts have the same weakness when a login is the only gate. See Case Study - Japan Brokerage Account Takeovers (2025), Brokerage and Investing, Cashback, Coupons and Rewards and Payments and P2P.
  6. Preserve evidence for prosecution. Login logs, payment-instrument metadata and withdrawal trails are what let prosecutors connect defendants. Build this into Fraud Incident Response and Case Documentation Standards.

Sources