Are crash games rigged? What provably fair means and where the real risk is

The multiplier is not rigged, and you can check that yourself in about a minute. The site you are playing on might be. This guide separates the two, because almost every 'Aviator scam' story we have investigated was the second problem wearing the first one's clothes.

Daniel Reyes, Editor-in-chief
Updated 20 October 2026 · Fact-checked by Tanvir Ahmed

We get this question more than any other, usually from someone who has just lost at 1.00x three times in ten minutes. The honest answer has two halves that most articles blur together. The game's random number is not rigged, and there is a way to prove it that takes a minute. The site serving you the game may well be a problem, and no amount of maths protects you from that. We will take them in order.

Provably fair, explained for a normal person

Imagine you and a friend bet on a coin flip, but your friend flips the coin in another room. You would want two things: proof that the result was decided before you placed your bet, and proof that it was not changed after. Provably fair is a way of giving you both using maths instead of trust.

The hash is the sealed envelope. The reveal is opening it. Your check is confirming the envelope was not swapped.

Here is how it works in a crash game, step by step.

The server picks a secret number. Before the round, the game server generates a random string called the server seed. This seed, run through a fixed formula, will become the crash point.

It seals the number in an envelope. The server runs the seed through a hash function (SHA-512 in Aviator, SHA-256 in most crypto originals) and shows you the result. A hash is a one-way fingerprint: the same seed always produces the same hash, but you cannot work backwards from the hash to the seed. So the game has committed to a result without telling you what it is.

Players add their own ingredient. In Aviator the first three players to bet in the round contribute a client seed from their devices. These get combined with the server seed. This step matters because it means the server could not have picked a seed that it knew would produce a low number: it did not know what the players would add.

The round plays. The combined seeds are hashed, the hash is converted to a multiplier by a formula that is published, and the plane flies to that multiplier and leaves.

The envelope is opened. After the round, the server seed and client seeds are shown in the round details. You hash the server seed yourself. If it matches the hash shown before the round, the result was fixed in advance. You hash the combination and run the formula. If it gives the multiplier you saw, the game paid what the maths said.

That is the whole mechanism. The operator cannot see your stake and pull the plane early, because the crash point existed before your stake did and was locked in a public fingerprint. If the plane ever seemed to crash "the moment you went big", you can now check that feeling against evidence. We have, hundreds of times. The evidence always wins.

How to verify a round in Aviator

Spribe put the tools in the game, though they are easy to miss.

1. Pick a round from the history strip. The row of coloured multipliers at the top of the game. Tap any one of them, ideally the one that annoyed you.
2. Open the fairness panel. A small shield or "provably fair" icon on the round details. It shows the server seed, three client seeds (with the usernames of the players who supplied them), the combined SHA-512 hash and the final multiplier.
3. Recompute the hash. Copy the server seed and the three client seeds, join them in that order with nothing in between, and paste the string into any SHA-512 tool. On a laptop, echo -n "string" | sha512sum does it. The output should match the hash in the panel character for character.
4. Recompute the multiplier. Take the first 13 characters of the hash, convert from hexadecimal to decimal, divide by 16 to the power of 13 to get a fraction between 0 and 1. The standard crash formula is 0.97 divided by (1 minus that fraction), floored to two decimals, minimum 1.00. We walk a full numeric example through this in how crash games work.
5. Change your own client seed if you like. Spribe lets you set a custom client seed in the settings. If you are one of the first three bettors in a round, your seed is part of the result. It is a nice way to be sure the inputs were not all chosen by the house.

If the panel is missing, greyed out, or shows a hash that does not match, you are not playing Spribe's Aviator. More on that below.

How to verify a round in Stake Crash

Stake's original Crash (the one with the 99% RTP and the 1,000,000x cap) uses the older Bustabit design, and it is arguably more transparent because the entire future of the game was committed years ago.

Stake generated a chain of ten million hashes in advance, each one the SHA-256 of the next. The last hash in the chain was published, along with a Bitcoin block hash chosen after publication as a public salt. Every round uses the next hash in the chain, combined with the salt through HMAC-SHA256, to produce the multiplier. Because each hash is the fingerprint of the previous one, Stake cannot insert or skip a round without breaking the chain, and because the salt came from the Bitcoin blockchain after the chain was published, Stake could not have chosen a chain that favoured it.

To check a round: open the game's fairness tab, copy the round's game hash, and paste it into the verifier on Stake's provably fair page (or into any of the open-source Bustabit verifiers, which take the hash and the salt and output the crash point). Confirm the multiplier matches. Then hash the game hash with SHA-256 and confirm you get the previous round's hash. That second step is what proves the chain is intact.

Roobet, Thunderpick and most crypto originals use one of these two models. Evolution's live Cash or Crash uses physical balls drawn on camera, which is a different kind of proof but an equally good one.

What a licence does and does not guarantee

People treat "licensed" as a synonym for "fair". It is a narrower promise than that, and knowing exactly what it covers is useful.

A licence does guarantee that the game software was tested by an approved laboratory (GLI, iTech Labs, BMM, eCOGRA) and that the RTP matches the published figure. It guarantees the operator holds player funds in a way the regulator can inspect, pays out on valid claims, and has a complaints route that ends with someone who can revoke the licence. In Kenya, for example, every brand we list holds a BCLB licence and the BCLB can and does suspend operators over payment complaints.

A licence does not guarantee that the site in front of you is the licensed one. Clone sites copy a brand's front-end, buy a lookalike domain, and run something that looks like Aviator with no connection to Spribe and no regulator behind it. It does not guarantee speedy withdrawals, reasonable bonus terms or a working support desk. And a Curacao or Anjouan licence, which is what most operators serving India, Pakistan and Bangladesh hold, offers a much weaker complaints process than a UKGC or MGA one. Weaker is not nothing, but it is not the same.

The practical rule: find the licence number in the site footer, go to the regulator's own register, and check the number against the domain you are on. If the register lists a different domain, close the tab.

The real risks and the imaginary one

After two years of reading complaints in our inboxes and in Telegram groups across four countries, this is where the money actually goes.

Imaginary: a rigged multiplier. We have never found one at a genuine Spribe, SmartSoft, Pragmatic, Evolution or Stake deployment, and we have checked when players sent us screenshots. The feeling of rigging comes from variance (a third of rounds end under 1.50x) plus memory (you remember the rounds where you had a big stake). The 3% house edge is the thing that actually takes your money, and it is printed on the game's info page.

Real: unlicensed clone sites. The biggest category. A domain like aviator-win-india or a WhatsApp link to "official Aviator" that leads to a site with no licence, no provider logo and a game that looks right until you notice there is no fairness panel. These are not rigged games in the cryptographic sense. They are not games at all; they are a deposit form with an animation attached. Several of the "Aviator took my money" stories we have investigated were sites that had been live for three weeks.

Real: fake apps. Spribe does not publish a standalone Aviator app. Every "Aviator app" on a third-party APK site, and a surprising number on official app stores, is either a wrapper around a casino's website (fine, if the casino is licensed) or a phishing shell that captures the login you type into it. Our predictor app guide covers the whole ecosystem, including the ones that bundle malware.

Real: withdrawal games. You win, you request a withdrawal, and a licensed-but-unscrupulous operator starts the dance: identity verification that takes eleven days, a bonus wagering requirement you did not know you had accepted, a "security review" with no end date, a maximum withdrawal of a fraction of the balance per week. None of this touches the game. All of it touches your money. It is the single most common complaint we receive and it is why every brand on our country pages is one we have deposited at, played at, and withdrawn from, with the timings recorded.

Real: bonus traps. A 500% welcome bonus with 40x wagering, where crash games count 10% towards it. You would need to turn over 20,000 units to release 500. Not fraud, just arithmetic, but it ends the same way.

Red flags: when to walk away

You do not need to verify hashes every session. You need to notice these.

• No licence number in the footer, or one that does not check out on the regulator's register for this domain.
• No provider branding inside the game. Real Aviator says Spribe in the corner and has the fairness panel. Real JetX says SmartSoft. A crash game with no provider named is a crash game somebody built in a weekend.
• The site is reachable only through a link from a Telegram group, a YouTube description or a "predictor" app, and has no presence anywhere else.
• Deposits via personal UPI IDs, individual JazzCash numbers or a stranger's bKash. Licensed operators use payment gateways. Agents collecting into personal wallets are a different business.
• A bonus you cannot decline, or terms that appear only after you have deposited.
• Withdrawal limits that are tiny relative to deposit limits, or that appear for the first time when you try to cash out.
• Support that answers in under a minute to deposit questions and in days to withdrawal questions. Test it before you deposit. We do.
• Reviews that all appeared in the same fortnight, on Trustpilot or anywhere else.

Two or more of these and we do not list the operator. One is enough to make us withdraw our test balance and watch what happens.

What to do if you think you have been cheated

If the game is a genuine provider build and you think a round was wrong, verify the round using the steps above and send the seeds plus your calculation to the operator's support, copying the provider. Spribe does respond. In two years we have not seen a verified round that did not match.

If the problem is a withdrawal, keep everything: screenshots of the balance, the request, every support message. Then complain to the licensing regulator by name, in writing. For Curacao-licensed operators that is the Curacao Gaming Control Board's complaint form; for Kenya, the BCLB; for MGA and UKGC sites, their own dispute routes and ADR bodies. Public complaints on the operator's social accounts work surprisingly well with mid-sized brands that care about their reputation.

If the site is an unlicensed clone, the money is usually gone. Report the domain to your payment provider and wherever you found the link, change any password you used there, and treat it as the cost of a lesson. The way to avoid it is to pick operators from a list made by people who have been paid by them, which is what our country pages are.

Gambling can be addictive. If you are chasing losses or playing with money you need, help is listed on our responsible gambling page. 18+ only.

Daniel Reyes

Daniel has written about online casino games since 2016 and has been playing crash games since the first Bustabit era. He owns the editorial standards on this site and signs off every global page.