Third DraftKings Credential-Stuffing Conspirator Sentenced to 18 Months

Nathan Austad is going to federal prison for 18 months. The sentence, handed down this week, also carries three years of supervised release and roughly $1.8 million in combined forfeiture and restitution payments — money that tracks back to a credential-stuffing campaign that drained accounts across the DraftKings sports-betting platform.

Austad is the third defendant sentenced in connection with the scheme. The failure mode here is not exotic: attackers bought or obtained lists of username-password pairs from previous breaches, ran them against DraftKings login endpoints, and cashed out accounts that reused credentials. No novel exploit. No zero-day. Just the long, grinding consequence of password reuse and an authentication surface that wasn't rate-limited or MFA-enforced tightly enough at the time.

In practice, credential stuffing sits in a frustrating middle zone for security teams. The traffic looks almost legitimate. It comes from distributed infrastructure — residential proxies, bot networks — that defeats naive IP-block rules. By the time your SIEM is alerting on anomalous login volume, the damage is already logged in your payments processor.

The $1.8 million figure is worth sitting with. That's court-ordered forfeiture and restitution combined, which means the actual harm calculation the government put in front of a judge was real money out of real user accounts. Not theoretical blast radius.

One thing the post-mortem will say — and probably already said internally at DraftKings — is that the detection gap between first compromised account and platform-wide response was the killzone. Legitimate gambling platforms process high-velocity transactions constantly. A credential-stuffing run that stays inside normal transaction envelopes is hard to distinguish from a good weekend in football season.

Three defendants sentenced. The case is closed on the prosecution side.

If you're running user-facing auth on any platform handling real money, mandatory MFA isn't a UX tradeoff anymore — it's the minimum viable control.