BoosterHand Lab · simulation

Can Crypto Casinos Cheat? I Built a Provably Fair Game to Find Out

Updated 2026-10-29 · By BoosterHand Lab · Method: Monte Carlo simulation (Python/NumPy, fixed seed)

Can crypto casinos cheat? Almost every crypto casino answers with the same two words: provably fair. The pitch is that the casino can’t rig your result and you can check it yourself, so I built a provably fair dice game from scratch, tried to cheat it, and then rolled it 200,000 times to see what the system really proves (and the one big thing it doesn’t).

If you want the full theory, our provably fair guide covers it in depth. This article is the hands-on version: real seeds, real hashes, real numbers from my own demo.

Provably fair: how it works in 4 steps

Provably fair is not one specific product. It’s a pattern built from two standard cryptographic tools: a hash function (SHA-256) and a keyed hash (HMAC-SHA256). Here’s how my demo game used them.

Step 1: the casino seals its server seed

Before you place a single bet, the casino picks a secret value called the server seed. In my demo it was bh-demo-server-seed-7f3a9c21.

The casino doesn’t show you the seed. It shows you its fingerprint: the SHA-256 hash of the seed. For my seed that was 0516de5d906f8cd6...eaa7848. Think of it as a sealed envelope. You can’t read what’s inside, but once it’s sealed, the contents can’t be quietly replaced.

Step 2: you add a client seed and a nonce

Next comes your input. The client seed is any text you choose. Mine was my-lucky-seed-42. Every bet also gets a counter called the nonce: 1 for the first bet, 2 for the second, and so on.

Why does your seed matter? Because the casino committed to its server seed before it knew yours. It can’t pick a server seed that produces bad results for you, since it doesn’t control the full input.

Step 3: HMAC turns the seeds into a roll

The game feeds the server seed, the client seed and the nonce into HMAC-SHA256. That produces a long hex string. My demo takes the first 8 characters, converts them to a number, and scales it to a range from 0 to 100.

My first roll came out at 91.76. Here are the first five rolls from the demo:

Step 4: you verify everything yourself

When you finish (or rotate seeds), the casino reveals the server seed. Now you do two checks:

1. Hash the revealed seed yourself with SHA-256. If it matches the fingerprint you saw before betting, the seed wasn’t swapped.
2. Recompute every roll from the seeds and nonces. If each one matches your bet history, no result was edited.

This is the part people mean when they search “verify provably fair”. Here is a generic Python version of my demo’s check. It’s short enough to run on any laptop:

import hashlib, hmac

server_seed = "bh-demo-server-seed-7f3a9c21"   # revealed after play
client_seed = "my-lucky-seed-42"
shown_hash  = "0516de5d906f8cd663d818fa4b55b4bfb98f897e7ad9c1c8ecaa6bb30eaa7848"

# 1. Does the revealed seed match the hash shown before betting?
print(hashlib.sha256(server_seed.encode()).hexdigest() == shown_hash)

# 2. Recompute each roll
for nonce in range(1, 6):
    msg = f"{client_seed}:{nonce}".encode()
    h = hmac.new(server_seed.encode(), msg, hashlib.sha256).hexdigest()
    roll = int(h[:8], 16) / 2**32 * 100
    print(nonce, round(roll, 2))

Real sites use their own exact formula (message format, how many characters, how the range is scaled), and they should publish it. The idea is the same everywhere.

Can crypto casinos cheat? I tried

Time to play the bad guy. I changed one single character in the server seed: the final 1 became a 2, giving bh-demo-server-seed-7f3a9c22.

The new SHA-256 hash started with 14c8e98f... instead of 0516de5d.... Not slightly different: completely different, from the first character to the last. That’s how SHA-256 is designed. A tiny change to the input scrambles the whole output, and nobody can work backwards to find a second seed with the same fingerprint.

So if a casino tried to swap its seed after seeing your bet, the hash check would fail on the first try. Caught instantly. That’s the real, useful power of provably fair.

Before the twist, a question for you: would you trust a provably fair game more than a licensed one? Why? Drop your answer in the comments below the video, because the next section might change your mind.

What provably fair does not prove

The cryptography held up. But “the result wasn’t changed” and “the game is fair to you” are two different statements.

The rolls were fair: 200,000 rolls tested

First, I checked the random numbers themselves. I rolled the demo dice 200,000 times and split the 0 to 100 range into ten buckets of 10 points each. A fair roll should put about 10% of results into each bucket, which is 20,000 rolls.

Every bucket landed within a whisker of 10%. Nobody was rigging the dice.

The house edge was still there

Now the twist. In my game, a roll under 49.5 wins and pays 2x your bet. That sounds close to a coin flip, but it isn’t quite.

• Win chance: 49.5% (the winning zone is 49.5 points out of 100)
• Payout: 2x
• Expected return: 49.5% × 2 = 99 cents per dollar

That rule hides a 1% house edge, in plain sight. Over 200,000 simulated rolls, players won 49.7% of the time and got back about 99.4 cents per dollar bet. That’s close to the 99% the rule predicts, with normal random noise on top.

Provably fair proves the result wasn’t changed. It does not remove the edge, because the edge lives in the rules, not in the random number. A 1% edge is small compared with many casino games, but it still adds up the more you bet. Our RTP simulation shows how that plays out over thousands of bets.

The things it never checks

Provably fair answers one narrow question: was this specific result tampered with? It says nothing about:

• Withdrawals. A perfectly fair roll is worth nothing if the site won’t pay you. Payout speed and reliability are a separate question entirely.
• Licensing. The math doesn’t tell you who regulates the operator or where you can complain. Our licences guide explains what Curacao and Anjouan licences cover.
• Every game on the site. A casino can offer provably fair dice next to games that don’t use the system at all. The label on one game doesn’t extend to the rest.
• The implementation. If the site doesn’t publish its exact formula, or doesn’t let you set your own client seed, you can’t truly verify anything.

How we ran the simulation

This was my own educational demo, not a copy of any real casino’s code. Here are the parameters:

• Commit: SHA-256 hash of the server seed, shown before play
• Roll: HMAC-SHA256 with the server seed as key and client_seed:nonce as the message, first 8 hex characters scaled to 0 to 100
• Seeds: server seed bh-demo-server-seed-7f3a9c21, client seed my-lucky-seed-42, fixed for reproducibility
• Tamper test: one character of the server seed changed (...c21 to ...c22)
• Volume: 200,000 rolls
• Game rule: roll under 49.5 wins, pays 2x, 1% theoretical house edge
• Result: 49.7% win rate, 99.4% return to player

Real implementations differ in details: some use more characters, different message formats or extra steps for games like cards. The core idea of “commit first, reveal later, recompute everything” stays the same. Our methodology page explains how we build and check all Lab simulations.

What this means for you

Provably fair is a real, useful protection, and my tamper test showed why: a casino can’t quietly swap the seed without getting caught. But it’s one check, not a seal of approval.

• Treat it as a minimum, not a reason to trust. It proves a result wasn’t changed after your bet. That’s all.
• Read the game rules for the edge. The payout table tells you how much the house keeps. Fair dice with a 1% edge still cost you money on average over time.
• Check the boring stuff too. Licensing, withdrawal track record and terms matter as much as the math. Our list of crypto casino red flags is a good place to start.
• Set your limits before you play. No verification system changes the fact that the expected result is a loss. If gambling stops being fun, take a break, and see our responsible gambling page for support.

Next in the Lab: is a casino bonus worth it? I gave a 100% bonus to 10,000 simulated players and did the math on wagering requirements.

Simulations use generic models, not any real game or casino. Results show long-run math, not predictions for one session. 18+ only. If gambling stops being fun, take a break: responsible gambling.

Next experiment: Is a Casino Bonus Worth It? I Simulated 35x Wagering on 10,000 Players