Z.ai, the Chinese model developer listed in Hong Kong as Zhipu, has raised about $5bn in a single move. Roughly $2bn came from placing 21.97 million new shares at HK$714, about 10 percent below the previous close.

The other $3bn came from RMB 20.14bn of convertible bonds maturing in September 2027, and those bonds carry no coupon at all.

Reuters reported the terms from the company’s filing. The bonds were priced to yield between minus 0.5 percent and zero, so buyers are taking a small certain loss on the debt in exchange for the option underneath it. They can convert at HK$892.5, a 25 percent premium to what the placement investors paid.

Lending money at a negative return only makes sense if the equity is what you actually want. On those terms, the bond is less a loan than a ticket, and the size of the book suggests plenty of people wanted one.

The money is earmarked for research, computing resources and infrastructure, expansion, strategic investments, possible acquisitions and working capital, which covers most things a company can legally do. The computing line is the one with a hard constraint behind it.

Z.ai has already built a data centre without Nvidia, running instead on Chinese-made accelerators, and scaling that approach is expensive in a way that buying the market leader is not. The company has not said how much of the $5bn goes to compute, or what it plans to buy with it.

In June, after its stock rose roughly 2,000 percent from a January listing, Zhipu was preparing a placement of several billion dollars. Analysts at the time said the company would stay deeply unprofitable and would need to keep raising for about three years. The first of those years is going well.

Revenue is climbing even though the product is largely free. Z.ai is approaching $1bn in sales while giving its strongest models away, and the stealth model that beat DeepSeek earlier this year was its GLM line. Open weights and a rising share price have so far proved compatible.

Z.ai priced the placement against Friday’s close. Two days before that, the NSA, FBI and CISA had named the company in an advisory on industrial-scale distillation, one of six Chinese firms the agencies accuse of extracting capability from American models.

The advisory alleges Z.AI pulled billions of tokens from GPT-5.5 and Claude Opus by mid-2026. Beijing called the advisory unfounded. Hong Kong investors put $5bn in three days later.

Export controls were written to restrict Chinese access to chips, and capital was never covered. Moonshot is reportedly raising $5bn of its own. Washington writes the rules on hardware, Hong Kong writes the cheques, and nothing in this week’s filing suggests the two are about to meet.

Deals on Microsoft Windows and Office for Mac licenses are heavily discounted this weekend, with prices dipping to as low as $9.97.

StackSocial is hosting deals on Microsoft Windows and Office licenses, with Windows 11 discounted to $9.97 and Office Home 2024 for Mac marked down to $112.97, the latter down from $179.

Shop Microsoft deals at StackSocial

It’s worth checking compatibility for the Windows license, as StackSocial states the version is designed for PCs that need a new license for Windows and if your PC is running Windows 10 and is unable to use Windows Update to install the free upgrade to Windows 11, you will not be able to install this version of Windows 11.

For the Office Home 2024 license, the one-use code will be connected with your Microsoft Account, rather than your actual device. It can be installed on one supported Mac or PC for non-commercial use.

This is also a standalone license for Office Home 2024 and it’s not Microsoft 365. At press time, Microsoft’s product lifecycle spans five years, and the company states Office 2024 will be retired on Oct. 10, 2029.

According to Stack, the codes, which are supplied by an authorized Microsoft Partner, must be redeemed within 7 days of purchase. See StackSocial for terms and conditions related to the offers.

HP has a new mini PC on sale in the U.S., and it is difficult to look at the machine without thinking of Apple’s Mac mini. The OmniDesk Mini has a similarly compact footprint and starts at $799.99, making it $100 cheaper than the recently announced M6 Mac mini.

The similarities mostly stop there. The base OmniDesk Mini is powered by Intel’s Core 3 304, a five-core, five-thread Wildcat Lake processor. It comes with 8GB of LPDDR5X memory and a 256GB SSD. HP also offers Core 5 320 configurations with up to 16GB of memory. So, despite the Mac mini-like dimensions, this is better viewed as a compact Windows PC than a direct rival to Apple’s latest desktop.

HP has packed plenty into a very small box

The OmniDesk Mini measures 5.12 x 5.12 x 1.89 inches and weighs just over a pound. For someone trying to free up desk space, that is probably its biggest attraction. HP has still managed to fit a useful selection of ports into the chassis. There are three USB-C ports, two USB-A ports, HDMI 2.0b, Ethernet, and several audio connections. The machine can also support up to three displays.

Storage can be expanded through two M.2 slots, but the LPDDR5X memory is onboard and cannot be upgraded later. Wi-Fi 6 and Bluetooth 5.4 come standard, with Wi-Fi 6E and Bluetooth 5.3 available as an option.

Who should actually buy the OmniDesk Mini instead of a Mac mini?

The bigger problem for HP is sitting only $100 higher up the price ladder. Apple’s M6 Mac mini starts at $899 and comes with 16GB of unified memory as standard. The Core 3 304 puts the base OmniDesk Mini in a much lower performance tier, so the $100 saving comes with a substantial compromise. Even the higher-end Core 5 320 configurations do not really change what this machine is.

I would mainly consider the OmniDesk Mini if Windows is a requirement or if Linux is part of the plan. For anyone comfortable with macOS, not strapped for cash, and willing to wait for the M6 Mac mini to ship, spending the extra $100 looks like the much stronger purchase.

No. Bangladesh’s Gambling Prevention Act, 2026 expressly makes involvement in online or remote gambling and online betting offenses. The law also reaches conduct such as using an online gambling account, making gambling-related financial transfers, certain promotional activity, and specified use of technical infrastructure to support or restore gambling access.

This article explains the published law in general terms and is not individualized legal advice. Actual criminal liability, procedure and sentencing depend on the facts of a particular case and the decisions of the relevant authorities and courts.

The Short Answer: Online Gambling and Betting Are Prohibited

Bangladesh now has a dedicated statute dealing expressly with online gambling rather than relying primarily on a nineteenth-century gambling law or a general cybercrime provision. The Gambling Prevention Act, 2026 was enacted as Act No. 98 of 2026 on July 1, 2026 and took effect immediately.

Section 5 states that a person involved in online or remote gambling commits an offense. Section 6 separately makes involvement in online betting an offense.

The distinction matters because the Act defines online betting broadly. It includes sports betting, live betting, exchange betting, casino betting, virtual betting, fantasy betting and esports betting. Online or remote gambling is also defined broadly enough to include more than simply operating a gambling website.

For example, using an online gambling account and placing an online sports bet are both activities the Act addresses, although the offenses and statutory maximum penalties are not identical.

What Changed on July 1, 2026?

July 1, 2026 was a significant legal transition. Bangladesh introduced a standalone gambling statute and, on the same date, enacted an amendment removing the gambling provision that had appeared in the Cyber Security Act, 2026.

The Gambling Prevention Act replaced the 1867 law

Section 49 of the Gambling Prevention Act expressly repeals the Public Gambling Act, 1867, while preserving specified earlier actions, orders and pending proceedings. The 1867 Act therefore should not be presented as Bangladesh’s current primary gambling statute when explaining the legal position in September 2026.

The change is substantial because the 2026 Act directly defines digital concepts that the 1867 law could not have contemplated, including online gambling accounts, digital gambling platforms, online betting, digital wallets, cryptocurrency and other digital assets.

Cyber Security Act section 20 is no longer the current gambling provision

The chronology is easy to misstate. Bangladesh enacted the Cyber Security Act, 2026 as Act No. 81 of 2026 on April 10, 2026. That law originally contained section 20 dealing with gambling in cyberspace.

However, the current Cyber Security Act records that section 20 was deleted by the Cyber Security (Amendment) Act, 2026. The official 2026 Acts register lists the Gambling Prevention Act as Act No. 98 and the Cyber Security amendment as Act No. 99, both dated July 1, 2026.

An article published before that change may have accurately cited Cyber Security Act section 20 at the time, but that provision should not be presented as the current primary basis for Bangladesh’s online-gambling prohibition.

What Counts as Online Gambling Under the 2026 Law?

The statute does not limit online gambling to running a casino website. Its definitions cover several kinds of conduct involving accounts, platforms, payments and participation.

Using an online gambling account

The Act’s definition of online or remote gambling includes opening, operating or using an online gambling account. It also includes operating online gambling websites, apps, servers or digital platforms and running gambling or betting groups, pages or channels on social media.

That wording matters because the statutory framework is not confined to bookmakers, platform owners or software operators. A person does not need to own the gambling platform for account activity to fall within conduct described by the law.

Casino and sportsbook activity

The Act separately defines online betting as betting conducted online, digitally or electronically on the outcome of a sport, competition, esports event, election, entertainment event or another event in return for money or property.

The listed categories include:

• sports betting;
• live betting;
• exchange betting;
• casino betting;
• virtual betting;
• fantasy betting; and
• esports betting.

The definition therefore reaches more than conventional sportsbook wagers. Casino betting and several newer forms of digital betting are expressly named.

Foreign gambling platforms are not outside the definitions

The definition of online or remote gambling also includes acting as a representative, agent or associate of a foreign online gambling platform. That matters because offshore operation does not place foreign platforms outside the subject matter of the Act.

A foreign gambling licence can regulate an offshore casino in the jurisdiction that issued the licence without changing whether Bangladesh permits residents to participate. Foreign licensing and domestic legality answer different questions.

The reviewed provisions do not create a general exception simply because an operator is based or licensed outside Bangladesh.

Are Deposits, Withdrawals and Crypto Gambling Covered?

Yes. The law connects gambling activity to its financial flows rather than treating account funding as an unrelated step.

The definitions of online or remote gambling include depositing, withdrawing or transferring money for online-gambling purposes. The Act also defines cryptocurrency and digital assets, including cryptocurrency, tokens, virtual coins, value stored in digital wallets and non-fungible tokens.

Section 14 addresses specified gambling-related use of financial systems, including banks, Mobile Financial Services, digital wallets, hawala, hundi and other financial arrangements. Mobile Financial Service, or MFS, refers here to mobile-linked financial services used for storing or transferring money.

The same section covers converting, storing or transferring gambling money or property through cryptocurrency, virtual assets or other digital assets. Section 25 provides that the section 14 offense is treated as a predicate offense under the Money Laundering Prevention Act, 2012.

A predicate offense is an underlying offense that can support a money-laundering case. This does not mean every bank, wallet or cryptocurrency transaction automatically becomes a money-laundering offense. The gambling connection and the elements of the applicable offenses still matter.

In practical terms, a bank, wallet or mobile-payment service being technically capable of processing a transaction does not make the underlying gambling activity lawful.

Does an Offshore Gambling Licence Make a Site Legal in Bangladesh?

No general foreign-licence exception appears in the reviewed provisions of Bangladesh’s Gambling Prevention Act. An offshore licence and Bangladesh legality operate at different jurisdictional levels.

A licence issued in Curaçao, Malta or another jurisdiction may establish that an operator is authorized or supervised there. It does not itself grant permission to customers in every other country.

This distinction is especially important when a gambling website uses its foreign licence as evidence that it is “legal.” That statement may describe its position in the licensing jurisdiction but does not answer whether the relevant activity is lawful in Bangladesh.

Understanding what a Curaçao gambling licence protects requires separating the regulator’s oversight of the operator from the law governing a customer’s location.

Likewise, comparing offshore and local gambling licences helps separate authorization issued in one jurisdiction from permission to offer or use gambling services in another.

What Does the Law Say About VPNs and Mirror Sites?

The Gambling Prevention Act does not establish a general ban on ordinary Virtual Private Network use. Section 12 instead addresses listed technical infrastructure when it is used for specified gambling-related conduct.

A Virtual Private Network, or VPN, routes network traffic through an intermediary server and can conceal or alter information about a user’s apparent network location. A proxy also acts as an intermediary, while the Act defines a mirror site as an alternative domain, copy or republished version of a previously blocked or prohibited gambling website.

Section 12 addresses using VPNs, proxies, mirror sites, hosting, domain services, cloud infrastructure, Content Delivery Networks or other technical infrastructure to operate gambling, conceal gambling information, assist gambling activity, reactivate a blocked gambling platform or use an alternative domain.

Section 23 provides the penalty for the section 12 offense. The qualification matters: saying simply that “VPNs are illegal in Bangladesh” would be broader than what this gambling provision states.

Likewise, the fact that a blocked or unavailable gambling platform can be reached through a mirror or another technical route does not establish legal permission to use it. Technical reachability and legality are separate questions.

A broader explanation of whether a VPN changes gambling legality must therefore distinguish network access from the law governing the underlying activity.

What Are the Penalties?

The Act does not assign one universal penalty to every gambling-related offense. The table below compares several statutory maximums relevant to online activity. These are maximum penalties written into the statute, not automatic sentences.

The official Act should be read for the exact elements of each offense. A statutory maximum is the highest punishment authorized by that provision; it does not mean every allegation or conviction produces that outcome.

Actual liability and sentencing can depend on the facts, evidence, charges, procedure and court findings in an individual case.

Can Gambling Sites or Accounts Be Blocked or Frozen?

The Act provides several enforcement mechanisms, but the existence of those powers should not be confused with proof that they have been used against a particular operator or account.

Section 38 authorizes the government or designated authority to block, remove or prohibit gambling-related websites, applications, servers, domains, IP addresses, URLs, social-media pages, groups, channels and other digital gambling platforms. Mirror sites, clone sites and alternative domains used for gambling activity may also be blocked.

Separate provisions address financial accounts and assets. Section 31 permits an investigating officer, with court permission, to temporarily freeze an accused person’s bank account, MFS account, digital wallet or crypto wallet when needed for an investigation. Section 29 allows a court to order confiscation of specified money, property and digital assets used in or obtained from an offense. Section 39 permits a court to order closure of specified financial accounts used for gambling.

For example, if a betting website suddenly becomes unreachable, blocking is one possible explanation. It would still be incorrect to state that Bangladesh authorities blocked that particular domain without direct evidence.

Likewise, the existence of account-freezing or closure powers does not establish that every gambling-related transaction automatically produces such an order.

What About Advertising, Influencers and Affiliate Links?

The Act also addresses specified gambling promotion rather than focusing only on players and operators.

Section 11 applies to persons and entities including media outlets, digital platforms, influencers, artists, athletes and celebrities when they conduct specified misleading gambling promotion, make false promises of profit, use inducement advertising, sponsorship, affiliate marketing or referral campaigns for gambling purposes. Section 22 sets a maximum penalty of 3 years’ imprisonment, a fine of up to Tk 50 lakh, or both for the section 11 offense.

This does not mean every journalistic mention, academic discussion or neutral reference to a gambling company automatically constitutes prohibited promotion. Whether conduct satisfies an offense depends on the facts and the statutory elements.

The distinction matters for publishers and influencers. A neutral legal explanation performs a different function from material designed to induce gambling participation, promise gambling profits or generate gambling referrals.

Which Law Should You Use for Current Bangladesh Gambling Information?

For the current position in September 2026, the starting point is the Gambling Prevention Act, 2026.

The Public Gambling Act, 1867 remains relevant to historical context and saved proceedings, but the new Act expressly repealed it. Cyber Security Act section 20 is also historical rather than current for this issue because the Cyber Security (Amendment) Act, 2026 deleted that provision on July 1, 2026.

This distinction matters when reading older articles. A page can have been accurate when written yet become outdated after a statutory amendment or replacement.

When evaluating a current claim about Bangladesh online-gambling law, check the publication date, the exact statute and section being cited, and whether a later law has amended, repealed or replaced that provision.

Bottom Line

Online gambling and online betting are expressly prohibited under Bangladesh’s Gambling Prevention Act, 2026. The law reaches more than platform operators: it addresses gambling-account use, online betting, gambling-related money transfers, specified promotional conduct and certain technical methods used to operate, assist or restore gambling access.

The current framework dates from July 1, 2026. The Public Gambling Act, 1867 has been repealed, and Cyber Security Act section 20 should not be presented as the current primary online-gambling offense because that provision was deleted on the same date.

A foreign licence, functioning payment method or technically accessible website does not independently establish that online gambling is lawful in Bangladesh. Anyone facing an actual investigation, charge, frozen account or other legal consequence should obtain advice from a qualified Bangladesh lawyer based on the specific facts.

A casino withdrawal can remain pending because the operator is still reviewing the request, completing verification, checking the payment method, or handling another compliance issue. A rejected withdrawal means that particular payout request did not proceed, but you still need the operator’s specific reason to know whether the problem is verification, payment routing, account rules, or something else.

The useful first step is not to guess how many hours a withdrawal should take. Identify the exact status, find out whether the casino has actually sent the money, and determine who currently controls the next step.

First, identify what the withdrawal status actually means

Withdrawal labels can look similar while representing different stages. There is no universal naming system across online casinos, so use the descriptions below as a diagnostic guide and confirm how your operator defines its own statuses.

For example, a bank cannot trace an external transfer that the casino has not yet sent. Conversely, if the operator confirms that the payment was sent and provides traceable transaction information, repeatedly asking the casino to approve the withdrawal again may not address the actual problem.

Pending or processing

A pending withdrawal generally means the request has not reached its final state. The unresolved step might involve routine internal review, Know Your Customer verification, a payment-method check, a source-of-funds review, or another account or compliance process.

Know Your Customer, usually shortened to KYC, is the process used to establish and verify who owns an account. In Great Britain, the Gambling Commission’s current customer identity verification condition requires covered remote licensees to obtain and verify information including the customer’s name, address, and date of birth before the customer is permitted to gamble. It also says a withdrawal request must not create an additional information requirement that the operator could reasonably have requested earlier, although information can still be requested later where another legal obligation requires it.

Approved or sent

Do not automatically treat “approved” and “sent” as the same event. An operator may use “approved” for an internal decision while “sent” indicates that a payment transaction has moved to the next part of the payment process. Because status terminology differs between operators, ask what each label means on the account you are using.

If the operator says the withdrawal has been sent, ask for the transaction or payment reference appropriate to the method, together with the sending date and destination. The exact reference format varies between banks, card systems, wallets, and payment processors.

A more focused process applies when a casino withdrawal is approved but not received: first establish whether the operator has actually handed the payment to an external provider, then trace that transaction rather than restarting the withdrawal process.

Rejected, declined, failed, cancelled, or returned

These labels should not be treated as interchangeable. A rejected request may reflect an account, verification, or payment decision. A failed payment may instead indicate that an attempted transaction could not reach its destination. A returned payment may have left one system and then been sent back.

Also check what happened to the balance. Rejection of a withdrawal request does not by itself prove that the money has been confiscated. The funds may have returned to the casino balance, remained restricted during a review, or been handled in another way that requires a specific explanation.

The main reasons a casino withdrawal stays pending

A delay becomes easier to investigate once you identify what the operator says it is checking. These causes occur at different stages, so the right response depends on which one actually applies.

Identity or account verification is incomplete

A casino may need to resolve an identity mismatch, unreadable document, outdated address, inconsistent account detail, or another verification issue. That does not mean every document request made after a withdrawal is automatically justified.

For British-licensed remote operators, the current identity-verification rule requires identity information to be obtained and verified before gambling and restricts operators from making a withdrawal conditional on information that could reasonably have been requested earlier. The rule still permits later information requests where another legal obligation requires them.

If verification is the stated blocker, ask which specific item is missing or cannot be verified. Do not repeatedly upload different documents without knowing what problem the operator is trying to resolve. A deeper explanation of casino KYC and source-of-funds checks can help distinguish ordinary identity verification from a separate financial-compliance review.

A source-of-funds or anti-money-laundering review is underway

Anti-money-laundering, or AML, controls are intended to identify and manage risks involving criminal proceeds and other prohibited financial activity. Source of funds refers to where money involved in a transaction came from. It is separate from simply confirming a customer’s identity.

The Gambling Commission’s 2026 risk assessment for remote casinos identifies issues including third-party payment methods, multiple payment methods, fraudulent identity documents, and open-loop payment arrangements among the risks relevant to the British remote-casino sector.

That does not mean a large or delayed withdrawal is automatically suspicious. AML controls are risk-based. The Gambling Commission has also said operators should not continue accepting deposits indefinitely and then rely on AML procedures to frustrate a withdrawal where relevant information should have been sought earlier.

There are circumstances in which an operator may be legally restricted from explaining an investigation in detail because disclosure could prejudice an anti-money-laundering matter. Outside such cases, the Commission says customers should generally be told why a withdrawal has been delayed and, where an operator decides not to process it, the basis for that decision should be explained in its guidance on account withdrawals.

The payment method does not match the account holder

A deposit funded through a payment method belonging to somebody else can trigger ownership and fraud concerns. Examples include a card in another person’s name or a bank or wallet account that cannot be matched to the casino account holder.

The Gambling Commission’s 2026 remote-casino risk assessment identifies use of a third-party payment method that is not in the customer’s name as a risk indicator. Its withdrawal guidance also notes that operators commonly use terms intended to prevent third-party payment methods or third-party funding.

If this is the problem, do not alter documents or create evidence to make the names appear consistent. Ask what ownership evidence the operator legitimately requires and provide it only through the operator’s official verification process.

The payout route cannot be reused

Some operators use a closed-loop payment model, which routes withdrawals and winnings back to the payment method used for the deposit. The Gambling Commission describes closed-loop payment systems as best practice for managing money-laundering risk and says open-loop systems can allow money to move between payment methods in ways that obscure the origin or destination of funds.

This should not be simplified into “every casino must always pay the exact same way you deposited.” Payment-method capabilities, operator rules, and applicable regulation can affect the available payout route. The useful question is whether your requested method is eligible and consistent with the operator’s verified payment policy.

The account or transaction is under review

An operator may review suspected duplicate or linked accounts, possible account takeover, inconsistent identity details, unusual payment activity, or an alleged breach of its terms. A review is not itself proof that the customer committed fraud or another breach.

For Great Britain, the Gambling Commission says an operator investigating a possible terms breach should normally explain that this is the reason for a withdrawal restriction. Where it decides not to process a withdrawal, it should generally provide the basis for the decision unless a legal restriction prevents disclosure.

Why a casino withdrawal can be rejected

A pending withdrawal remains unresolved. A rejected withdrawal has reached a decision or payment outcome that stopped that request in its current form. The next step is to identify which part failed.

Verification failed

The operator may have been unable to verify a document, account detail, payment-method owner, address, date of birth, or another required item. Ask for the failed requirement by name rather than assuming that “KYC failed” explains the problem.

The payment method or account owner does not match

A destination may be ineligible because the operator cannot establish that you control it, because the route conflicts with its payment controls, or because the method cannot accept the requested payout. If the casino proposes another route, verify that route through the operator’s official payment instructions before supplying financial details.

A contractual or promotional condition is disputed

The operator might claim that a promotion, account rule, wagering condition, payment restriction, or another contractual term affects the withdrawal. Read the exact term the operator says applies rather than relying on a generic support message.

For British licensees, a published term is not automatically beyond challenge merely because it appears in the terms and conditions. The Gambling Commission’s current fair and transparent terms condition requires covered operators to use contractual terms and consumer notices that satisfy applicable fairness and transparency requirements and to comply with their terms.

Historical Competition and Markets Authority enforcement also addressed withdrawal barriers including low withdrawal limits, arbitrary identity-verification deadlines, and promotional terms that restricted access to a player’s own deposited money. Those CMA enforcement findings provide British consumer-law context from the 2017–2019 enforcement programme and should not be treated as a universal rule for casinos licensed elsewhere.

A compliance or security review blocks the transaction

A rejected request can sometimes be one step in a broader account process rather than a final decision about the balance. For example, an operator may reject one payout destination while requiring legitimate additional verification. Ask whether the rejection is final, whether the balance remains available, and what process now applies.

The payment itself failed

A withdrawal can also fail after an attempted payout if the destination is closed, cannot accept the transaction type, contains incorrect details, or rejects the payment. In this situation, establish whether the casino actually attempted the transaction and whether the funds were returned.

Casino withdrawal troubleshooting by symptom

When does a delayed withdrawal become a complaint?

There is no defensible universal number of hours or days after which every casino withdrawal becomes improper. Processing rules differ by operator, payment method, jurisdiction, verification state, and whether the transaction has actually left the casino.

A stronger test is to compare the delay with observable facts:

• Has the operator exceeded the processing period it published for that withdrawal method?
• Have you supplied every legitimate item the operator specifically requested?
• Can support identify the exact unresolved stage?
• Has the operator’s explanation changed repeatedly?
• Does the operator claim the payment was sent but fail to provide available information that would allow it to be traced?
• Has a rejected withdrawal left the balance in an unexplained state?

Withdrawal friction is a documented regulatory concern in Great Britain. In a July 2024 publication, the Gambling Commission said withdrawal delays were its largest complaint category and that its Contact Centre continued to receive around 2,000 complaints a year about delayed withdrawals. That is a 2024 regulator figure, not a measurement of complaint volume in 2026.

The same guidance says operators should not create unnecessary withdrawal friction or rely on anti-money-laundering procedures merely to frustrate a withdrawal where relevant information should have been obtained earlier. It also says customers should generally be told why a withdrawal is delayed or not processed, subject to legal limits such as avoiding prejudice to an anti-money-laundering investigation.

How to escalate an unresolved casino withdrawal dispute

Escalation depends on the casino’s actual licence and the jurisdiction governing the account. A complaints process published by one regulator should not be assumed to apply to an operator licensed somewhere else.

Use the operator’s formal complaints procedure first

Submit a concise chronology containing the account identifier, withdrawal amount, request date, transaction ID, current status, relevant verification history, and the outcome you are requesting. Attach only the evidence necessary to establish the dispute.

For Great Britain, the Gambling Commission’s consumer complaint procedure says customers should first complain directly to the gambling business and follow its complaints policy. The business has 8 weeks from receiving the complaint to resolve it.

Use the applicable independent dispute process

For a British-licensed operator, an unresolved eligible dispute may then proceed to an Alternative Dispute Resolution provider. Alternative Dispute Resolution, or ADR, is an independent dispute process outside the operator. The Gambling Commission’s ADR guidance, updated on 15 May 2026, says customers must first go through the gambling business’s own complaints procedure and describes ADR as a free, independent service. It says an unresolved complaint can be taken to an ADR provider after 8 weeks.

The Gambling Commission does not resolve every individual gambling dispute itself, and the British process should not be generalized to every country. Other jurisdictions can use different regulators, dispute bodies, eligibility rules, and complaint deadlines.

Verify which licence actually covers the casino

Before escalating, verify the operator’s gambling licence using the relevant regulator’s own register or another authoritative licensing record. A logo in a website footer does not by itself establish that the domain, company, or account you used is covered by that licence.

Once the regulator and licence holder are confirmed, follow the complaint path published by that authority. If you cannot establish a legitimate licence or company identity, treat the situation as a separate operator-verification or potential fraud problem rather than assuming a conventional licensed-casino dispute process applies.

What not to do while a withdrawal is unresolved

• Do not make another deposit simply to release the withdrawal. Verify any unusual payment demand independently before sending more money.
• Do not falsify KYC or payment-ownership evidence. False documents can create additional fraud and compliance problems rather than fixing the original withdrawal.
• Do not repeatedly cancel and recreate the withdrawal without a specific reason. Doing so can complicate the transaction history and may affect processing.
• Do not send passwords or authentication secrets. Do not give support your password, one-time login code, full card security code, crypto seed phrase, or remote-access credentials.
• Do not ask a bank to trace a payment that the casino has not sent. First establish whether an external transaction actually exists.
• Do not file a false payment dispute to recover legitimate gambling losses. A withdrawal dispute concerns money that should be paid or properly explained, not a way to reverse unrelated valid gambling transactions.

Bottom line

A pending or rejected casino withdrawal is best handled as a transaction-status problem rather than a guessing contest about payout speed. Find the exact stage, identify whether the casino or an external payment provider controls the next step, obtain the specific reason for any hold or rejection, and preserve the records that support your timeline.

If the operator has sent the payment, trace that transaction through the relevant payment route. If the operator still controls the request and cannot resolve or adequately explain it, use the formal complaint process that applies to the casino’s verified licence jurisdiction.

Threat actors linked to a China-aligned espionage group are exploiting a critical vulnerability (CVE-2026-51990) in Tencent’s Sogou Input Method for Windows to deploy the GrayRabbit backdoor.

Researchers at cybersecurity company Gen Digital warn that the security issue is a one-click remote code execution (RCE) flaw.

“We observed this vulnerability actively exploited in the wild by the UNC3569 threat group to deploy the GRAYRABBIT backdoor through a crafted link,” Gen Threat Labs says.

Sogou Input Method is a popular Windows application that lets users type Chinese characters using a standard keyboard and also offers a custom link handler and a built-in web browser using an outdated Chromium engine.

Developed by Chinese tech giant Tencent, Sogou Input Method reportedly has hundreds of millions of installations in China.

Gen Threat Labs reports that UNC3569 chains three weaknesses in the product:

1. an unvalidated command-line argument injection in the sgbiz: URI
2. an unrestricted URL navigation in a CEF-based webview
3. an outdated, unsandboxed Chromium browser engine

The attack chain starts with the victim clicking a crafted sgbiz: custom URI, causing Windows to invoke Sogou’s biz_helper.exe protocol handler, which passes attacker-controlled command-line arguments to the legitimate SGMyInput.exe executable without validating them.

The attacker-injected arguments open Sogou’s skincenter component and instruct its embedded Chromium webview to load an attacker-controlled URL. Sogou does not restrict the URL’s scheme or destination.

In the third stage, a malicious page exploits a known vulnerability in Sogou’s outdated Chromium 80 engine. Because the browser runs without a sandbox and with important web-security protections disabled, the exploit achieves code execution and installs the GrayRabbit backdoor.

In 2024, Google researchers described GrayRabbit as a modular malware family and linked it to UNC3569, a China-based threat actor operating across both the cybercrime and cyber contractor-for-hire ecosystems.

The malware sample that Gen Threat Labs analyzed is a more mature 64-bit variant with an expanded command set and RC4-encoded command-and-control (C2) configuration.

Its capabilities include process execution, opening interactive reverse shells, uploading and downloading files, collecting system and user information, and reflectively loading plugins in the host’s memory.

Gen Threat Labs reported their findings to Tencent on April 9, and the software vendor deployed a fix in Sogou Input Method version 16.3.0.3498, released on April 21.

The patch validates the URL arguments accepted through the protocol handler, permits only HTTPS, and restricts navigation to approved domains related to Sogou and Tencent.

However, the researchers warned that the underlying browser remains outdated and still runs without a sandbox, with many web security protections disabled.

Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.

Save your seat

Watch Alexander Zverev vs Ben Shelton in the 2026 US Open men’s final as the American takes to Arthur Ashe Stadium in front of his home crowd looking to become the first American man to win a Grand Slam singles title since Andy Roddick at the 2003 US Open.

Zverev, meanwhile, comes into the final on a hot streak, reaching his third consecutive Grand Slam final after winning Roland Garros earlier this year before losing to Jannik Sinner in the Wimbledon final. The top seed made a slow start in New York, needing five sets in each of his opening two rounds, but has since won 13 consecutive sets, including straight-set victories over Botic van de Zandschulp in the quarterfinals and Karen Khachanov in the semis.