How We Review Crypto Casinos — Our Full Methodology

ProofBets exists because most crypto casino reviews are either paid promotions, surface-level opinions, or both. Our methodology is built on three pillars: mathematical verification of game fairness, first-hand withdrawal testing with timestamped evidence, and independently audited tipster records. This page explains exactly how each works.

If you find a claim on this site and want to check our working, everything on this page tells you how. That is the point.

---

Part 1 — How the ProofBets Provably Fair Verifier Works

The ProofBets Provably Fair Verifier is a cryptographic auditing tool. It takes the three inputs that define a provably fair bet — the server seed, client seed, and nonce — and independently calculates what the outcome should have been, using the same algorithm the casino claims to use. If the casino's recorded result matches the calculated result, the bet was demonstrably fair. If it does not match, you have cryptographic proof of a discrepancy.

Here is the complete process.

The Three Inputs

Server seed. Before any bets are placed, the casino generates a secret random string — the server seed. They do not show you this string directly. Instead, they show you a hashed version of it: SHA-256(serverSeed). This hash acts as a cryptographic commitment. Because SHA-256 is a one-way function, it is computationally infeasible to reverse the hash to discover the original seed. The casino has, in effect, locked in their randomness before the game starts, without revealing it to you.

Client seed. This is a string you control. Every legitimate provably fair casino lets you set your own client seed before betting. Your client seed is mixed with the server seed to produce the final result. Because you chose it, the casino cannot have pre-calculated an outcome that accounts for it. You can change your client seed at any time, which also triggers the reveal of the previous server seed (ending that seed chain and allowing full retrospective verification).

Nonce. The nonce is a counter that increments with every bet. Starting at 0, it increases by 1 for each wager you place within a single seed chain. Its purpose is to ensure that every bet produces a unique result even when the server seed and client seed remain constant. Without the nonce, every bet in a session would produce the same outcome.

The HMAC-SHA-256 Calculation

The three inputs are combined using HMAC-SHA-256 (Hash-based Message Authentication Code with SHA-256). The formula is:

HMAC-SHA-256(key = serverSeed, message = clientSeed + ":" + nonce)

HMAC is a specific construction that uses a cryptographic hash function (in this case SHA-256) with a secret key. The key is the server seed. The message is the client seed and nonce concatenated with a colon separator. The output is a 64-character hexadecimal string — 256 bits of pseudo-random data.

Why HMAC and not raw SHA-256? Raw SHA-256 is vulnerable to length extension attacks. HMAC avoids this by applying the hash function twice with inner and outer padding derived from the key. For the purposes of gambling verification, what matters is that HMAC-SHA-256 with the server seed as key produces output that is unpredictable without knowing the server seed — and that once the server seed is revealed, the output is fully reproducible by anyone.

A Worked Example with Real Values

Consider the following hypothetical seed chain:

Server seed (revealed after session):
  a3f8c2d1e5b94720f6a1839c4d0e7b52a1c8f3e6d294b70e5a182d4c9f3b1e7

Client seed (chosen by player):
  myCustomSeed_2026

Nonce: 14 (this is bet number 14 in this seed chain)

The verifier constructs the HMAC input as:

message = "myCustomSeed_2026:14"
key     = "a3f8c2d1e5b94720f6a1839c4d0e7b52a1c8f3e6d294b70e5a182d4c9f3b1e7"

HMAC-SHA-256 output:
  7d4e1b8f2a930c56e4b71d8f3a920c45e1b84d7f2930a56c4e71b8d3a920f45

Mapping the hash to a game result. The first 8 characters of the hex output are extracted: 7d4e1b8f. This is converted to a decimal integer: 2,100,290,447. Dividing by the maximum 32-bit unsigned integer value (4,294,967,295) produces a float: 0.4888... This float is then multiplied by the game range. For a dice game with outcomes 0–9999: 0.4888 × 10000 = 4888. If the casino recorded 4888 for that bet, the result is verified.

Our verifier automates every step above. You paste in the three inputs and it returns the calculated result alongside the casino's claimed result. The comparison is instantaneous and requires no trust in ProofBets — you can replicate it yourself in any browser console or using any HMAC-SHA-256 library.

What the Verifier Can and Cannot Prove

The verifier proves that a specific game outcome was determined by the stated seeds and nonce, using the stated algorithm. It cannot prove anything about the game logic that sits above the algorithm — the rules that translate the hash output into a win or loss. A casino could theoretically implement a fair hash function but apply it through game rules that are unfavourable to players. This is why our verification guides always pair cryptographic verification with independent RTP testing and community complaint monitoring.

See our full guide: What is Provably Fair? A Complete Technical Explanation — including worked SHA-256 examples, a verification walkthrough, and a comparison of casinos with genuine vs claimed provably fair implementations.

---

Part 2 — How We Conduct Withdrawal Tests

Withdrawal testing is the most operationally demanding part of our review process and the most important. Every casino on this site has been tested with real cryptocurrency withdrawals. We do not accept stated withdrawal times from FAQ pages. We measure them.

The Standard Test Protocol

For each casino we review, we conduct a minimum of three withdrawal tests across a single review period:

1. Small withdrawal — typically 0.001 BTC or the equivalent in the casino's primary crypto. This tests whether small withdrawals are processed with the same priority as larger ones, which is not always the case.
2. Medium withdrawal — typically 0.01 BTC or equivalent. This tests whether the casino's processing pipeline scales, and whether enhanced KYC or manual review is triggered at mid-range amounts.
3. Altcoin withdrawal — one withdrawal in a secondary currency (ETH, LTC, or USDT depending on casino support). This tests whether non-Bitcoin withdrawals are handled consistently, as many casinos outsource or batch-process altcoin withdrawals differently.

Each withdrawal is documented with:

• A screenshot of the withdrawal request with the casino's transaction timestamp visible
• A screenshot of the receiving wallet confirmation with block timestamp
• Elapsed time calculated from request to first on-chain confirmation
• Any fees charged by the casino (separate from network fees)
• Whether any identity verification or manual review was triggered

Why Three Tests Per Casino

A single withdrawal test is not statistically meaningful. Processing times vary based on network congestion, casino staffing hours, blockchain mempool conditions, and whether a withdrawal triggers automated or manual processing. Three tests across different amounts and currencies give a more reliable picture of what a player will actually experience.

We weight the medium withdrawal time most heavily in our scoring, because it reflects the experience of a player making a normal-sized withdrawal — not an edge case.

Withdrawal Speed Scoring

Our withdrawal speed score (contributing 15% to the overall rating) is calculated as follows:

KYC and Verification Triggers

We note every KYC request made during the withdrawal process, including what documentation was requested and how long verification took. This matters because some casinos advertise "no KYC" but require verification at withdrawal thresholds that are not disclosed upfront. We consider undisclosed KYC triggers a significant negative factor and reflect this in the review.

Withdrawal Data Transparency

Every review that includes withdrawal test data displays the raw timing numbers — not rounded summaries. If our medium withdrawal took 4 hours and 22 minutes, that is what the review says. We also note the date of each test, because withdrawal speeds can change as a casino scales or encounters operational issues.

---

Part 3 — How We Audit Tipster Records

The tipster industry has a structural fraud problem. Because past performance cannot be independently verified in most cases, fabricated records are common and difficult to detect without specific auditing methods. Our tipster verification standard is designed to make fabrication either impossible or detectable.

What Constitutes a Verified Record

A tipster record is only considered verified by ProofBets if it meets all of the following criteria:

1. Contemporaneous posting. Tips must have been posted publicly before the event result was known. We verify this using timestamped posts on Telegram channels, Twitter/X, or dedicated tipping platforms with immutable post timestamps. Screenshots are not accepted — the original post must be accessible at its original URL.
2. Minimum 90-day sample period. A record covering fewer than 90 days does not contain enough data to distinguish skill from variance. Our standard requires 90 days of continuous posting across at least 200 tips for a meaningful yield estimate. We explicitly state when a record does not yet meet this threshold.
3. Complete record — wins and losses. Any tipster who posts only winning bets is, by definition, curating their results. A verified record includes every tip posted during the sample period, not a selection. We cross-reference the full post history to confirm completeness.
4. Consistent unit sizing. Unit size manipulation is the most common form of ROI inflation. A tipster who silently increases stakes on wins and reduces them on losses will show a misleading yield. Our audit uses the unit sizes as they were posted, not as-claimed in retrospect. If unit sizes changed during the period, we note it and calculate yield under both regimes.
5. Third-party audit or accessible raw data. Where a tipping platform provides an independent audit trail (e.g. Pyckio, Tipstrr, or Betaminic verified records), we use that audit trail directly. Where no third-party audit exists, we build the P&L record manually from the original post history.

The 90-Day Proofing Standard — Why 90 Days

90 days is a minimum, not a target. It is the point at which, for most sports betting markets, a yield of over 5% ROI can be considered statistically distinguishable from chance at the 95% confidence level — assuming a sample of 200+ tips at near-even odds. Below this threshold, a hot streak is indistinguishable from skill.

For niche markets (e.g. handicap Asian lines, exchange scalping) or long-cycle sports (e.g. horse racing outright markets), we apply a higher minimum: 180 days or 500 tips, whichever comes later. The confidence interval needed to distinguish signal from noise is higher in lower-volume, higher-variance markets.

How We Detect ROI Manipulation

The five manipulation methods we screen for are documented in detail in our guide How to Spot a Fake Tipster. In summary:

• Selective memory: Cherry-picked wins in promotional posts versus full record P&L discrepancy. We compare both.
• Retrospective posting: We check whether tips were posted before kick-off using platform timestamps. Telegram channels allow post editing — we note where edited timestamps are present.
• Unit size manipulation: We audit the unit sizes as-posted across the full sample and calculate flat-stake yield independently.
• Start date gaming: We check whether the claimed start date is the actual earliest post date, or whether earlier posts (including losses) have been excluded.
• Sample size gaming: We check for gaps in posting history that correlate with losing runs, indicating the tipster paused or restarted during downswings.

Yield vs Strike Rate — Our Primary Metric

Strike rate (percentage of bets that win) is the metric tipsters lead with because it is more intuitive and easier to game. A tipster backing 1.10 shots will win 91% of the time and still lose money. We report strike rate for completeness but base our assessment entirely on yield (ROI):

Yield = (Total profit in units ÷ Total stakes in units) × 100

A yield of +5% or above sustained over 90+ days and 200+ tips is our threshold for considering a tipster's record statistically meaningful. Below this, we note the record but do not make a recommendation.

---

Part 4 — The 10-Point Casino Review Framework

Every casino review on ProofBets uses the same 10-point framework. Here is what each criterion covers and how it is weighted in the overall score.

Our Rating Scale

---

Editorial Independence Statement

ProofBets earns revenue through affiliate partnerships with crypto casinos. When you click a "Visit Casino" button and sign up, we may receive a commission. This is how the site is funded.

This relationship does not affect our ratings. No casino can pay for a higher rating, a more favourable review, or inclusion in a roundup. The commercial relationship is disclosed upfront on every page that contains affiliate links, per our affiliate disclosure policy.

Our editorial process is designed so that commercial decisions are downstream of editorial ones: we decide which casinos to review based on their relevance and player demand, we conduct the review, and only then do we apply for or activate an affiliate relationship. If a casino's review score is below 7.0, we do not include affiliate links regardless of commercial opportunity.

If you believe a rating is inaccurate, we want to hear about it. Contact us through the about page. We investigate every substantive challenge to our ratings.

Methodology version: 1.1 | Last updated: March 2026