How a Pro Gamer Actually Made Money From Hackers DDoSing His Server

Earlier this week, pro gamer James “PhantomL0rd” Varga claimed that the worst thing ever had happened to him: His gaming servers were being targeted with false traffic (a DDoS attack) from a hacking group called DERP, which made it impossible for him to make a living from his livestream. As things escalated, armed cops showed up at his door over a fake "hostage situation" someone had called in as a prank. At some point, DERP also sent him pizza.

At least, that's the story you might have heard. On closer inspection, Varga’s ordeal is not a simple “bullied by online trolls” story, or even true.

First, Varga wasn’t the only one targeted, nor was he their initial target. Gaming servers for League of Legends, Dota 2, Battle.net, Club Penguin, and Quake Live, as well as servers for EA.com and Blizzard, were knocked down in the US and Europe for anywhere from 15 minutes to a couple of hours by this DDoS attack on Monday. By the afternoon, servers in Asia were also affected. DERP claimed responsibility for the DDoS attack.

DDoS attacks of game servers isn’t a new phenomenon. When I spoke to Belgian pro-gamer Athene Wins over Skype in 2012, he called DDoSing a "plague growing very fast" as a tool some gamers were using in order to force the other player to “lose connection so they then win the game." Wins went on to explain, “We’ve had to cancel finals, sponsored events, tournaments, everything… We’ve lost titles, lost tournaments, lost prizes… It’s pretty crazy.”

DERP’s attack, however, wasn’t carried out to unseat a victor for money; they attacked gaming servers as pure trolls, simply for the lulz. After going public with their intentions on Twitter, Varga noticed it was also affecting his servers and contacted DERP via private text chat. He began communicating with them, even passing on questions his fans had about why DERP was doing what they were doing, to which DERP said they wanted to make money-hungry companies like EA mad.

Varga then made a deal with DERP over his Twitch livestream; if his team began losing, DERP would DDoS his server, one of the few that weren’t down at the time. Varga’s team began to lose, and the hackers kept their promise.

Game Informer news editor Mike Futter speculated (along with some Redditors) that Varga reached out to DERP instead of alerting moderators and site operators in an attempt to boost his subscriber count. Explains Futter:

This went on for hours, and rather than stop streaming, Varga watched his viewer count skyrocket past 100,000. All the while, he displayed advertisements and raked in new subscribers at $4.99 per month per membership. Varga put his channel in "sub mode," which means that the only way to participate in the conversation via chat is to pay.

As Varga’s stream continued and more games were taken down, including Disney’s Club Penguin, he reveled in his role. “It’s chill to intervene with you, the public, the fans, and with these guys,” he says. As Varga watched his revenue increase, EA, Riot Games, Valve, Disney, and others were crippled and their businesses impacted. Yet, Twitch allowed the stream to remain live. It allowed Varga to casually make deals with the DDoSers in conflict with Twitch's own terms of service.

Word had spread that Varga was in contact with the DDoSers and he essentially held court among curious gamers wanting to be close to the action, for a fee. According to metric monitoring site SocialBlade, Varga picked up 14,000 new subscribers on Monday during the server outages. At $4.99 per person to subscribe, stats indicate that Varga’s channel pulled in $69,860 that Monday (it’s not clear how much of a cut Twitch takes Update: Twitch takes half), refuting his claim that these DDoSers prevented him from making a living that day.

Further, all the video evidence Varga himself posted shows he wasn’t an unassuming victim as he joked with DERP and actually welcomed the DDoS attack on his server should his team start losing.

Okay, so what about the police at his home, the arrest he video-blogged about? The BBC reported that “more than a dozen armed police responded to the call, which resulted in Mr Varga being arrested and handcuffed,” a fact they got from a video by Varga. VentureBeat wrote that Varga took photos and a video of the police officers and shared them on his livestream, “so he could prove he wasn’t lying,” words again from Varga.

According to Futter, who spent days interviewing local law enforcement, the Los Angeles Police Department “flatly denied anything of the sort in their jurisdiction." Glendale PD also implied parts of Varga’s tale of being arrested were far-fetched. “There is no proof of his allegations,” concluded Futter via Twitter DM.

Even the video VentureBeat claimed Varga shared on his livestream doesn’t seem to exist—it can’t be found in his video response recorded streams, in any subsequent videos, or on his Twitter or Facebook. A photo he posted the next day of a single police car could be legit, but it doesn't show exactly what kind of response he may have gotten, and it is certainly not 15 police officers shoving a gun in his face as he claimed. Meanwhile, there are plenty of Photoshopped images of Varga getting arrested, made by his fans.

The police arrest story, however, did increase his global profile. Even newspapers in Sweden wrote about his "ordeal." Besides gaining paying subscribers on Twitch on Monday and Tuesday, Varga picked up more than 9,000 YouTube subscribers immediately following the DDoS/arrest story. There is no subscriber revenue on YouTube, but SocialBlade calculated his yearly earning estimate off ads is as high as $184,000. So unlike the gaming companies that lost revenue during the server downtime, Varga made a tidy profit off the backs of a cyber crime perpetrated by someone else.