- How Plinko Odds Are Supposed to Work
- November 2025: ProvablyFair.org Tested It And It Was Clean
- December 17, 2025: Originals 2.0
- February 2026: ProvablyFair.org Pulled the Code
- What the Modified Probabilities Actually Looked Like
- How Many Bets Were Affected
- March 10: Winna Issued an Incident Report
- Why the “Configuration Error” Explanation Raises Questions
- Issue with How the Game Was Built
- What You Can Do
- March 14: The Code Was Fixed
- The Bigger Picture
ProvablyFair.org conducted an independent technical audit of Winna.com’s Plinko game. What they found was a probability system that quietly gave players worse odds than the site publicly stated — and it ran that way from December 17, 2025 to around March 10, 2026.
If you played Winna Plinko during that window, your bets were placed under those modified probabilities. Here’s what the code actually showed.
How Plinko Odds Are Supposed to Work
Plinko is built on simple math. Each pin the ball hits sends it left or right — a 50/50 coin flip. It’s called a binomial distribution, and it’s not negotiable.
For a 16-row board, the edge bucket — the one with the 1000x multiplier — should come up roughly 1 in every 32,768 drops. When you see “1000x” on the edge of a Plinko board, that’s the probability you’re naturally assuming.
November 2025: ProvablyFair.org Tested It And It Was Clean
As part of their routine research into provably fair casino games, ProvablyFair.org ran 67.5 million simulations of Winna’s Plinko across 25 real seed pairs. The results were clear: HMAC-SHA256 randomness, per-pin left/right simulation, standard binomial distribution, and RTP converging to ~99%. At that point, the math was sound.
One thing they did flag even then: Winna wasn’t letting players set their own client seed — something virtually every other provably fair casino supports. As one commenter put it:
“Until this last week, a player had no input over the client seed… which I have never seen before and always made me suspect something fishy.”
ProvablyFair.org noted this at the time, but since the RTP was still converging correctly across 67.5 million simulations, the math itself checked out.
December 17, 2025: Originals 2.0
Winna launched “Originals 2.0” — a rebuild of their in-house games. The announcement was celebratory. What wasn’t announced was that Plinko had quietly stopped simulating the path of the ball through the pins.
Before this update, the game worked the way you’d expect: randomness determined whether the ball went left or right at each row, one flip at a time, 16 times. The final landing position determined your payout.
After December 17, that changed entirely.
February 2026: ProvablyFair.org Pulled the Code
They extracted the Plinko game logic directly from Winna’s live frontend JavaScript. What they found wasn’t a ball simulation. It was this:
- Generate a single random number between 0 and 1
- Map that number against a hardcoded probability table
- The table tells the game which bucket you land in
No path – just a lookup table that the house controls completely. The same code was independently archived by the Wayback Machine on January 27, 2026 – before the extraction and before any public disclosure.
The table controls the game. And the table had been modified.
What the Modified Probabilities Actually Looked Like
For High Risk, 16 rows: the 1000x edge buckets were reduced by roughly 32%. Fair math says you should hit the edge once in every 32,768 drops. The actual code put that at 1 in 48,188. The board still displayed “1000x.” The odds behind it were quietly worse.
What makes this stand out is the precision of everything else. For High Risk with 16 rows, 14 of the 17 buckets matched the fair binomial distribution to 10 decimal places. Only three buckets differed: the two 1000x edge buckets were reduced, and the 0.2x middle bucket absorbed the stolen probability. The rest of the distribution was left perfectly intact.
That same pattern appeared across every difficulty setting. Higher-paying buckets were shaved down, and that probability was quietly moved into the lowest-value middle buckets. In Medium Risk, the 41x bucket was reduced by 88%. In Low Risk, the 2x bucket was reduced by 99.5%. Every mode ended up converging to almost exactly 98% RTP — down from the advertised ~99%.
As @YogiGambles put it:
“Imagine a carnival game that advertises a huge prize, but behind the scenes the operator secretly makes it harder to win while the sign stays the same. That’s basically what happened here.”
How Many Bets Were Affected
Hundreds of millions of bets were placed across all Winna games between December 17 and March 10. ProvablyFair.org can’t determine exactly how many were Plinko bets specifically. But Plinko was heavily promoted during the Originals 2.0 launch and remained live under these modified probabilities for nearly three months.
March 10: Winna Issued an Incident Report
Winna sent an email to affected players acknowledging the issue. Their explanation: a “configuration error” had caused 98% RTP probabilities — intended only for a new Extreme Mode — to be applied to all modes instead. They said players who were negatively affected could request a refund through live chat support.
ProvablyFair.org’s own test account, which placed verified Plinko bets during the affected period, did not receive this notification.
Player @sink_wesley reported wagering hundreds of thousands of dollars on Winna Plinko 16 High during the affected period, being told by support his account was unaffected — and then being banned within 24 to 48 hours with no explanation from support. He wasn’t alone in raising this. Several players who publicly questioned the incident report have reportedly faced similar outcomes.
Why the “Configuration Error” Explanation Raises Questions
The configuration error framing doesn’t sit easily with what the code actually showed. A misconfiguration would be messy. What was in the tables was precise.
Each difficulty had its own distinct probability profile. Only the higher-paying buckets were reduced — not random ones. The stolen probability was redistributed specifically to the lowest-value buckets. The rest of the distribution matched binomial math with extreme precision. And every single mode converged to almost exactly 98.00% RTP.
@CoinBets put it bluntly:
“Hard to believe that was just a mistake.”
Issue with How the Game Was Built
Before December 17, Winna’s Plinko used proper provably fair logic — the kind you can independently verify. Each bet generated 16 random coin flips, and you could check every one of them.
The new system generates a single float and maps it to a table. You can verify that the float was generated fairly. But you can’t verify the table itself from the outside — you have to trust that it matches what’s advertised. When the table is hardcoded in the frontend JavaScript and the casino can update it with any deployment, that’s a meaningful reduction in verifiability.
@Gwoti framed it well:
“If the odds were really changed without telling players, that’s not right. People deserve transparency when real money is involved. Changing probabilities while showing the same board just destroys trust.”
What You Can Do
ProvablyFair.org has published a verification tool where you can enter your seed pair and nonce range to see which of your bets would have produced different outcomes under fair binomial math versus the extracted tables. You’ll need your unhashed server seed — available after seed rotation — and your client seed from your Winna bet history.
If your account was affected, Winna said to contact their 24/7 live chat support to claim a refund. Given the reports of players being banned after raising questions, it’s worth documenting everything before you reach out.
March 14: The Code Was Fixed
ProvablyFair.org extracted the live code again on March 14. Low, Medium, and High modes now use fair binomial coin-flip logic, restoring ~99% RTP. The fix appears to be in place.
The Bigger Picture
This case is a good illustration of why independent third-party verification matters when casinos build and run their own games. Winna’s pre-December implementation was clean — ProvablyFair.org confirmed that. The issue came in with a major update that was deployed without any public change to the advertised odds.
When a casino runs its own in-house games, controls its own frontend, and can push updates without external audit, the burden of trust is enormous. Provably fair systems exist precisely to remove that burden. When the implementation quietly shifts away from a verifiable model — and players have no way to know unless someone pulls the code — that’s exactly the kind of gap that independent audits exist to catch.
That’s exactly what happened here.
Read our full Winna review to learn about other scam tactics they use.
