Eight Oripa sites accused of rigging: black-box pulls are finished, and why Parrot backs only CARDZ.GAME

Japanese lawyers have publicly named eight online Oripa operators, filed a complaint with the Consumer Affairs Agency, and announced that they are pushing ahead with civil refund suits for victims and criminal complaints for fraud. In the same month, Clove’s admin panel for influencer boosts surfaced and JTCC’s draw history came back attached to the wrong accounts. The business of black-box god pulls is finished.

Key points

  • Eight Oripa operators have been named by lawyers and taken to the Consumer Affairs Agency, with Clove and DOPA both on the list.
  • The lawyers are explicit about the remedy they want: civil refunds and criminal complaints, in a market where losing several million yen is not unusual.
  • What you pay for is a chance, and the terms of that chance can be rewritten in an admin panel. How would you know which version you are drawing against?
  • CARDZ.GAME built fairness as something you can check for yourself: verifiable RNG, third-party audits, every pull written on chain, and public external dashboards.

1. The list of eight is not a rumour, it is a lawyer’s filing

On 7 September, the law firm Hibiki (響) published a long post on X. Online Oripa, it argued, has swollen into an enormous market with no dedicated regulation and no supervision, and the way these businesses operate may breach the Consumer Contract Act, the Act on Specified Commercial Transactions and the Act against Unjustifiable Premiums and Misleading Representations. Depending on how they actually run, the conduct could even amount to fraud under the Act on Punishment of Organized Crimes. Individual losses in the millions of yen are not rare, and the firm points to cases running into tens of millions and even hundreds of millions.

The same day brought the announcement: the firm has filed a complaint with the Consumer Affairs Agency against the leading operators over suspected breaches of the Specified Commercial Transactions Act, and it is advancing civil refund suits for victims alongside criminal complaints for fraud and related offences. On 8 September, the post restating that the agency had been notified climbed to roughly 6.04 million views.

The eight named publicly:

  1. DOPA! Oripa (DOPA!オリパ) — sinsa Inc. (株式会社 sinsa)
  2. Oripa One (オリパワン, ORIPA ONE) — KECAK Inc. (株式会社 KECAK)
  3. Nihon Toreka Center (日本トレカセンター, JTCC) — Nihon Toreka Center Inc. (株式会社日本トレカセンター)
  4. EX-TORECA (エクストレカ) — Mirai Laboratory Inc. (株式会社ミライラボラトリー)
  5. Orikuji (オリくじ) — H&F Inc. (株式会社 H&F)
  6. Clove Oripa (クローブオリパ, Clove) — TrustHub Inc. (株式会社トラストハブ)
  7. Pocket Cross (ポケットクロス) — Potion Inc. (ポーション株式会社)
  8. Minna no Toreka (みんなのトレカ) — Eight Inc. (株式会社エイト)

The two names Hong Kong players know best, Clove and DOPA, are on the list together. On 9 September the lawyers pressed further: what looks like an Oripa company on the surface is propped up by payment-agency infrastructure handling settlement, and responsibility will be pursued there as well.

Let us be precise about one thing. A complaint is a knock on the door, and no ruling has come down. But the words the lawyers are using in public are no longer about unclear labelling. They are refund suits and criminal fraud complaints, and for an industry that sells chance, the risk has already been rewritten.

2. Where the rigging shows: histories can slip, and luck can be configured

Between 20 and 21 August, JTCC’s draw history broke. Players found winning records from accounts they had never heard of inside the pools they had bought into, while their own wins turned up under someone else’s name. The platform later admitted that the storage of display data had failed, and in doing so revealed something far more important about the architecture: the draw records and the front-end display are two independent systems.

Which means the history you are looking at is not the same thing as the record of what was actually drawn. How exactly are you supposed to reconcile them?

From 5 September, the Clove admin investigation pushed the problem one level deeper. Inside the public code of the management front end, an influencer boost interface was reconstructed: pick a CloveID, set the boost level and the validity period, then fill in a reason, with the reason field prompting for 「施策名・配信予定」, the campaign name and the broadcast schedule. Working from that interface, the chance of hitting the headline prize in a ten-pull is estimated to rise from roughly 10% normally to as much as 45%. The same material contains scheduleAssignGuaranteedWinOripaUsers, which reads literally as scheduled assignment of guaranteed-win users, and it appears across the Japan, Hong Kong and United States inventory lists.

Which means the god pull a KOL lands on stream can be a result arranged in advance in an admin panel. You watch the clip, you deposit, and your account faces which odds? How would you know?

The main investigation and the full evidence chain draw the line clearly: what has been verified are functions and strings inside a public front end, and per-execution records have not been obtained. But once people can see that the capability exists, the next question writes itself. Have you used it? On whom? And did you tell the people paying?

Put the three acts together. The history you can see slips between accounts, the admin panel carries an interface for adjusting luck, and lawyers have delivered a list of eight names to the Consumer Affairs Agency. The money you hand over buys a chance, and the terms of that chance can be rewritten out of sight. Black-box platforms cannot answer that question, because their business model is built precisely on your inability to answer it.

3. So ask the obvious question: which of those platforms would do any of this for you?

Stop for a moment and think about the platform you are using right now.

  • Does it let you verify the random result of every single pull yourself, or does it simply ask you to trust it?
  • Are its draw records and its front-end display the same system, or two of them, the way JTCC turned out to be?
  • Is there an external dashboard showing how big the fund pool is and where the money went, or only an official statement?
  • Has its random number generation been audited by a third party, or can it be adjusted per account from the back office?

The eight named operators cannot answer a single one.

CARDZ.GAME answers all four, and not with marketing copy but with mechanism. The official site puts it plainly: “Verifiable RNG. Third-party audited. On-chain transparent.” and “Every pull is recorded and independently verifiable.”

Unpack that and it is four separate things.

1. The randomness can be verified. Draws run on verifiable RNG and accept third-party auditing. You do not have to take anybody’s word for their fairness, because the random result itself leaves a trace that can be reviewed. There is no per-account boost option in the back office, because once a result is on chain, changing one number is visible to everyone.

2. Every pull goes on chain and can be looked up. Draw results and the related data are recorded on chain, and anyone can trace them. Against JTCC’s two systems, there is only one here, and it is not the platform telling you so, it is there on chain to read.

3. Funds and operating data sit on external dashboards. The official site states that the protocol’s data is listed on DefiLlama, that settlement runs through liquidity infrastructure, and that transactions are verifiable. BlockTimes reports that the pool used for buybacks and payouts reaches US$4.6M, with the data checkable on chain. How big the pool is and where the money went is no longer a matter of official say-so.

4. You can walk away the moment you pull. Cards you do not want convert straight back into Points so you can keep opening, with the official site stating “Instant Points buyback”, and the brand promise this site has verified is an exclusive full buyback of up to 100%. If you want the physical card instead, it ships worldwide with tracking and insurance, graded and delivered to your door.

BlockTimes reports that the platform recorded 200,000 pulls in its first month and shipped physical cards to over a hundred players. Founder Tatematsu Takeo (立松武夫) describes the goal as building a genuinely transparent draw environment, one where players can check every piece of data and never have to worry about manipulation.

4. Change the ruler: stop asking how pretty the jackpot art is and ask three hard questions

QuestionThe eight named operatorsCARDZ.GAME
Can the result be checked by a third party?Only the platform’s own history page, and that page can slipEvery pull on chain, independently verifiable
Is the randomness verifiable RNG?“Trust us”, with per-account boosts available in the back officeVerifiable RNG, third-party audited
Are funds and operating data on an external dashboard?NoOfficial site states a DefiLlama listing, with the pool checkable on chain

This table is not a promise that you profit on every pull. No platform can say that. What on-chain records and verifiable RNG solve is a different problem entirely: they move trust from believing a brand to reviewing the evidence. And Clove, JTCC and the lawyers’ filing together prove that believing a brand is a model that has already died.

Pulling cards is not the sin. Refusing to be verified is. Your money belongs where people are willing to let you check.

5. Fairness is not its selling point, it is its foundation

On the platforms out there, fairness is the line in the advertisement. On this one, fairness is written into the architecture, where it cannot be edited.

Random numbers have to survive a third-party audit before anyone can say there is no per-account tuning. Every pull has to go on chain before anyone can say the history does not slip. The fund pool has to sit on an external dashboard before anyone can say the money is really there. Buybacks have to be instant before anyone can say your points are not trapped. Miss one of the four and you are back in a black box. All four together is what fairness means.

So in a climate where Japanese Oripa operators are being named collectively by lawyers and admin boost panels are surfacing in public code, fairness stops being a bonus feature and becomes the price of entry. This platform has taken that route since day one and is still building on it, which is why Parrot puts its weight behind it.

6. Parrot has a position, and an invite code

Some people say that recommending a platform costs you your credibility.

Parrot’s answer is simple. Because it is fair, we recommend it. Rules stated up front, results that survive being checked, and only then does anything get recommended here. That ruler was applied to Clove and it applies to CARDZ.GAME in exactly the same way. If this platform stops meeting the standard, Parrot will write that too.

CARDZ.GAME is currently the only pack platform Parrot actively recommends. If you decide to try it, use Parrot’s invite code MXQAQ9 and go in through this referral link.

Disclosure: MXQAQ9 is this site’s referral code, and if you register through that link this site may receive a referral reward from the platform. None of that changes a single verification standard above.

7. Three things to do yourself, whichever platform you choose

  1. Screenshot the rules before you open. Pack rules, odds statements, buyback and shipping terms: copy them down yourself before you place an order. For how it all works, read the Cardz.game guide.
  2. Check your pull afterwards. Go through card name, print run, language and grade item by item. To see where a card sits in the PSA 10 market, match printing and date on CardZ Marketcap, with the walkthrough in PSA 10 price lookup.
  3. If money is still stuck on a black-box platform, do not deposit more to chase it. Keep your payment, draw, shipping and support records, and do not delete the account or the chat logs. The reader appendix in the Clove admin investigation explains how to preserve them.

FAQ

Have the eight platforms already been ruled fraudulent?

No ruling has come down. Hibiki filed a complaint with the Consumer Affairs Agency and announced civil suits and criminal complaints. As of writing, there is no public finding of illegality by the agency, no administrative penalty and no guilty verdict. But the language the lawyers are using in public is refund suits and fraud complaints, not unclear labelling.

If pulls are on chain and the RNG is verifiable, does that mean I will win?

No. Verification solves the question of whether the result was tampered with, not how high the hit rate is. Every card draw carries odds, and no profit is guaranteed anywhere. The difference is that with the eight named operators you cannot even find out whether the result was tampered with.

What do I do with cards I do not want?

Convert them straight back into Points and keep opening, as the page shows, under the brand promise this site has verified of an exclusive full buyback of up to 100%. If you want the physical card, request shipping with tracking and insurance. Points are an internal unit on the platform and should not be read as a cash value, and thresholds and postage are covered in the shipping to Hong Kong and Points guide.

Line up Clove, DOPA and CARDZ.GAME cell by cell. Who wins?

On years in operation the rivals win. On every other cell checked against the official pages, CARDZ.GAME comes out ahead. The two colour-coded tables sit in how to pick an online pack platform and on the comparison page, each cell traceable back to the official wording.

Why use the invite code MXQAQ9?

It is Parrot’s referral code, and this site may receive a referral reward from the platform, as disclosed above. Using it or not makes no difference to the draw conditions you face.

Next steps

To open a pool directly, go to CARDZ.GAME with invite code MXQAQ9. To understand how it works, read the Cardz.game guide. To compare Clove and DOPA cell by cell, open how to pick an online pack platform. To see how a back office can adjust your luck, read the hidden controls in Clove’s admin panel.

Sources

A note on the data: as of writing, the Consumer Affairs Agency has made no public finding of illegality against the operators concerned; view counts are taken from the figures displayed on X; the figures of roughly 460 victims and 3.1 billion yen are a secondhand aggregation and are not used in this article. On-chain verification and third-party dashboards improve what can be checked, and do not constitute an investment or profit guarantee.