At Carnegie Mellon in Pittsburgh, a team that included Taro Tsuchiya and Nicolas Christin measured two years of one narrow crypto trap. Attackers planted lookalike addresses in people’s transaction histories and waited for someone to copy the wrong one. In a study presented at USENIX Security 2025, the team counted 270 million attempts aimed at 17 million victims, with at least $83.8 million lost.
That risk belongs to only one answer to the headline question. Which wallet a player needs depends less on taste than on the kind of site, because each kind decides which payment routes it will take. A state-licensed casino works through routes its regulator has written down, and most of them pass through a bank or a card the player already has. An offshore site that takes only crypto hands the player a far longer list of jobs.
The sections below take three kinds of sites in turn and compare the routes on custody, identity checks, fees, speed, and what happens when a payment goes wrong. Licensed casinos come first. Sweepstakes sites come second, because they change when the payment question comes up at all. Crypto-only sites come last, since they ask the most of whoever holds the keys.
Michigan’s funding rule has no line for a crypto wallet
Michigan opened regulated online casinos in January 2021, and its administrative code spells out how a player account may be funded. Rule 432.655a, in force since December 2020, allows a credit or debit card, cash paid in at a cashier’s location the board has approved, an ACH transfer, a wire, and a reloadable prepaid card that has been checked as the player’s own and can’t be passed on. Promotional credit, the player’s own results, and operator adjustments also count, along with a catch-all: “Any other means approved by the board.”
Nothing on that list is a crypto wallet. For a licensed site in Michigan, the realistic answer to the headline is often that a player needs nothing new. A checking account covers ACH and wires, and a debit card covers the card line. An e-wallet has to come in through the catch-all, which makes it an approved extra rather than a requirement.
Identity is just as specific. Rule 432.655 has the operator record a legal name, date of birth, home address and at least the final four Social Security digits, then verify age and identity and log the date. A post office box won’t pass. Every route on the funding list starts from that verified file.
Apple Pay and Google Pay rewrap the card you already carry
Apple Pay and Google Pay feel like separate wallets, but at checkout they draw on a card already stored in the phone. Apple’s security documentation describes the swap. When a card is added, the issuer creates a device-specific Device Account Number that Apple says never sits on its servers, and each payment carries a security code unique to that transaction. Apple says neither it nor the device sends the real card number to the app.
Google’s version changed shape in 2024. The standalone Google Pay app stopped working in the US on June 4 of that year, and Google Pay as a service carried on through Google Wallet, which stores credit and debit cards. Either way, paying with a stored card leaves the money where it was, with the issuer, rather than in a new balance on the phone.
The card’s issuer still sets the terms. Capital One’s help center counts using a credit card to buy casino chips or lottery tickets as a cash advance, which it says usually means a transaction fee and a higher APR than a purchase. Whether an online casino payment falls in that bucket depends on each issuer’s terms. Disputes also run through the issuer, and the FTC notes that credit and debit cards carry legal protections if something goes wrong.
PayPal adds an account, not a safety net
PayPal is the first wallet in this piece that a player would actually have to open, and it comes with its own gatekeeping. Its Acceptable Use Policy lists casino games among the activities a merchant needs PayPal’s pre-approval to accept, and only where the law allows it for both the operator and every customer. Its user agreement also lets PayPal make whatever inquiries it considers necessary to verify an account holder’s identity.
The surprise sits on the buyer’s side. PayPal’s Purchase Protection terms, last updated in January 2026, list “any other activities with an entry fee and a prize” among the transactions the program excludes, in the same line that names gaming. The account adds a layer between the bank and the casino, but the program’s refund coverage isn’t part of that layer.
A plain bank transfer often does the same job with fewer moving parts. Nacha, which governs the ACH network, estimates that 80% of ACH payments settle in one banking day or less, and Regulation E limits a consumer’s liability for unauthorized electronic transfers. Prepaid cards sit in between. The federal prepaid protections attach once the issuer has finished verifying the holder, so an unregistered card can miss the liability limits and error resolution a registered one gets.
A sweepstakes site needs no wallet to start
Every route so far exists to move money from an account the player controls into a site before play begins. The sweepstakes model runs in a different order. Play starts on coins handed out for free, so the payment question comes later, if it comes at all.
Spree Casino sets out that sequence in its overview of the model, Sweepstakes Casino, which covers the two coins, the sign-up steps and the minimums for redemption. Gold Coins (GC) exist only for play and have no redemption route. Spree Coins (SC) do, and the site’s terms rule out purchasing them, so promotions supply them instead, through routes that include daily coins and a handwritten request sent by post.
The start is where the difference shows. A new account receives 25,000 GC + 2.5 FREE SC with no purchase, and the same terms state that no purchase is needed to set up an account or play. A player can sign up, collect coins and play without linking a card, a bank account or anything else.
That doesn’t make payment methods disappear. Players can buy Gold Coins packages, and the terms require the name on the payment method to match the name on the account. Redemption has checks of its own. Gift cards need at least 10 SC and cash at least 100 SC, counting only SC won in play, and both follow age and identity verification. The sweepstakes rules then send cash solely to an account held at a bank in the player’s name, or by check at the operator’s discretion.
That is the advantage, put precisely. Nothing needs opening to start, and the account at the far end of a cash redemption is an ordinary bank account, the kind most households already hold. The FDIC’s 2023 household survey found that only 4.2 percent of US households had no checking or savings account at all.
Crypto-only sites leave custody to you or to an exchange
Offshore sites that take only crypto operate outside the state licensing described above, and they ask for one thing before anything else: a crypto wallet. That makes custody the first decision. FinCEN’s 2019 guidance for crypto businesses draws the line plainly, calling wallets whose funds a third party controls “hosted wallets” and those the user controls “unhosted wallets.”
An exchange account is the familiar hosted kind. FinCEN treats a hosted wallet provider as a money transmitter that must identify, verify, and monitor its users, so opening one means an identity check, and every payment to a casino adds a hop from the exchange to the site. The exchange holds the keys, and the player holds a login. If the company storing the wallet goes out of business or is hacked, the FTC notes that the government has no obligation to step in.
Self-custody removes the host and hands the whole job to the player. Many wallets show a 12- to 24-word recovery phrase at setup, and the BIP-39 specification behind recovery phrases, assigned in 2013, builds each phrase from a fixed list of 2,048 words. The spec notes that the sentence “could be written on paper or spoken over the telephone.” That’s the convenience and the danger in one line.
Those words are the wallet. Whoever reads them can rebuild it, unless an extra passphrase guards it, and whoever loses them has nobody to call. After a lost password or a compromised wallet, the FTC warns, a holder is likely to find that “no one can step in to help you recover your funds.”
Speed and cost change shape too. Bitcoin adds a block about every 10 minutes on average, and Bitcoin.org lists six confirmations as its minimum recommendation for high-value transfers, so about an hour at that pace. A fee below what the network is prioritizing can leave the first confirmation waiting considerably longer.
A pasted address can’t be called back
Bitcoin.org states the rule without softening it: a transaction “cannot be reversed; it can only be refunded by the person receiving the funds.” The FTC says much the same of crypto payments in general. For a player sending crypto to a casino, that turns the address field into the most expensive box on the screen.
The poisoning pattern the Pittsburgh team measured hasn’t faded. AMBCrypto’s breakdown of a $100K poisoning loss described a victim who lost more than $100K in USDT after copying a lookalike address from transaction history. The attacker swapped the USDT into ETH 72 seconds after it landed, to get ahead of a possible freeze, since Tether can freeze its token.
Set side by side, the routes in this piece differ most in the last column.
| Route | Who controls the money | Who verifies identity | If a payment goes wrong |
| Card in Apple Pay or Google Pay | The bank or card issuer | The issuer and the licensed site | The issuer’s dispute process |
| PayPal | PayPal | PayPal and the licensed site | Purchase Protection excludes entry-fee-and-prize payments |
| ACH from a bank account | The bank | The bank and the licensed site | Regulation E limits on unauthorized transfers |
| Prepaid card in the player’s name | The issuer | The issuer and the licensed site | Regulation E, once the issuer has verified the holder |
| Hosted crypto wallet | The host, such as an exchange | The host, as a money transmitter | Usually final, with no FDIC coverage |
| Self-custody wallet | Whoever holds the recovery phrase | No one | Usually final, and a lost phrase can’t be reset |
The choice, then, turns less on which wallet is best than on how much of that last column a player is willing to give up. Every licensed route keeps a bank, card issuer, or payment company between the player and a mistake, with a state regulator behind the site. A crypto-only site takes both away and moves custody, address checking, and the cost of an error onto the player. That trade deserves a deliberate answer before anyone opens a wallet for it.
Disclaimer: This is a paid post and should not be treated as news/advice.
Be the first to comment