Look at any mystery box site today and the structure underneath looks almost identical. Cyprus Ltd up top, a Delaware US LLC handling card payments, and terms that swear it isn’t gambling. Same playbook across the niche. Here is how it actually fits together — and why it is a positioning story more than a licensing one.
- Cyprus is the default address. Most major operators — LuxDrop, Cases.gg, Rillabox, Jemlit, EmpireDrop, PackDraw, Box Madness, Hypedrop, MrLoot, and Lootbox.com — run through Ltds in Limassol, Nicosia, or Strovolos for the 12.5% corporate tax rate and easy fintech banking.
- US Delaware LLCs handle the payments layer. Cases.gg, PackDraw, Pullbox.gg, and Boxed.gg all pair their main entity with a Delaware LLC so card processors don’t choke on the Cyprus side.
- Nobody bothers with Malta or Curaçao gambling licenses. They cost real money and force you to admit you’re gambling — and the whole point of this setup is to say you’re not.
- The “we’re not gambling” toolkit is always the same five moves: free-to-play coins, XP and rakeback so users “never lose”, sweepstake framing, GPT tasks for free entries, and guaranteed-product framing.
- Crypto-only withdrawals aren’t a feature, they’re legal cover. No fiat off-ramp means no clear cash-out, which makes the gambling label harder to stick.
- High revenue, no VAT ID — and Cyprus gets talked about openly as a tax haven. Registering for VAT would force these companies to admit they operate inside the EU, so most just don’t.
- Hypedrop is the structural outlier. Main site sits under a Belize parent (Plutonomy Limited) with a Cyprus Ltd (Omnifarious Services) handling payments — different shell, same logic.
- Structure isn’t a moat. Lootie, HypeLoot, BOXY.gg, and Hybe all had clean-looking setups too, and all of them are gone. We are not lawyers — do your own research before you trust any of this.
Cyprus is the address — and the address means something
The dominant pattern in mystery boxes today is a Cyprus Ltd sitting at the top of the cap table. LuxDrop (Indubitably Services Ltd, Limassol). Cases.gg (CGG Entertainment Ltd, Nicosia). Rillabox (TechNexus Ltd, Limassol). Jemlit (JLT Digital Media LTD, Strovolos, after being moved out of a London company in 2025). EmpireDrop, PackDraw, Box Madness, MrLoot, Lootbox.com — same address pool.
The headline reason is the 12.5% corporate tax rate, but that is only half of it. Cyprus also runs an IP Box regime that taxes qualifying intellectual property income at an effective rate closer to 2.5%, and it’s a member state of the EU, which means payment institutions and bank accounts can be opened more easily than from an offshore jurisdiction like Belize or the BVI. EU passporting for fintech partners is the quiet draw — Cyprus is technically EU on paper, but socially it’s been a soft-touch jurisdiction for online gaming and forex for two decades, and the banking ecosystem there is used to gambling-adjacent flows.
Honest take: the choice of Cyprus is less about tax savings on profit and more about the combination of “EU enough to bank” and “not so EU you have to admit what you do for a living”. A real gambling license in Malta or Curaçao costs six figures a year, requires audited RTPs, mandatory responsible-gambling tooling, and very pointedly classifies you as a gambling operator. Cyprus gives you the EU stamp without that classification.
The Delaware LLC sitting on top of the payments
The second half of the playbook is what most consumers never see: the US LLC that sits between the Cyprus parent and the card processor. Cases.gg routes payments through CasesGG US LLC in Delaware. PackDraw pairs its main entity with PackDraw US, LLC, also Delaware. Pullbox.gg runs as a Delaware LLC outright. Boxed.gg is Washington-state-incorporated.
The reason is mechanical: Stripe and most mainstream card acquirers will quietly suspend mystery box merchants if the underlying entity is a Cyprus Ltd in this category, but they handle US LLCs in the same vertical with much less friction. A US LLC also makes it easier to onboard with US-customer-facing payment infrastructure (Plaid, Apple Pay, ACH rails) that an offshore-flavoured Cyprus entity would struggle to access. Whether it also gives the operator any US-state-level regulatory positioning is a separate question — and in this niche it’s likely both reasons stacked on top of each other.
The “we’re not gambling” toolkit
The structural choices above only work if the operator can credibly tell a regulator, an acquirer, or a payment partner that the product isn’t gambling. The toolkit for doing that is remarkably consistent across the niche. It’s five moves, mixed and matched:
| Move | Operators that use it |
|---|---|
| Free-to-play coins (sweepstake) | Cases.gg (Gold Coins), most operators offer free play modes |
| XP / no-loss rewards | Hypedrop, LuxDrop, Cases.gg, Rillabox, Jemlit, Box Madness, EmpireDrop |
| Daily free crates | Hypedrop (up to 10), LuxDrop (up to 14), Cases.gg (up to 10), Rillabox, Jemlit, MrLoot, Pullbox.gg, Lootbox.com |
| Guaranteed product / minimum return | Hybe (originator), MrLoot, Box Madness |
| Participation fee framing | Pullbox.gg (explicit), PackDraw |
| GPT (no-real-value coins) | EarnLab (Malta — the GPT outlier) |
Cases.gg states across the site that the platform is “100% free to play and any deposits are fully optional”, and its deposit modal frames purchases as buying Gold Coins with the spendable credits described as a “free bonus”. Box Madness writes in plain text that the site “guarantees that you always get at least the value you paid for”. EarnLab sits on the GPT model — coins earned through tasks officially have no real-world value, even though the site clearly runs on the same engagement loop as the rest of the niche.
Honest take: none of these are legal opinions in the formal sense. We have not seen a public memo on Cases.gg or Cravin saying “the firm of X concludes the platform does not constitute gambling under jurisdiction Y.” What we have seen is the construction — the free-play layer, the no-loss XP, the guaranteed product, the credits-not-tokens language — written into terms and modals so that, if it ever comes up, the operator has a paper trail of “here is why we believed in good faith we weren’t a gambling operator”. That is a posture, not a license.
The concrete example: Hypedrop, Coffeezilla, and Denmark
The cleanest real-world case study of this playbook in motion is Hypedrop versus the Danish Gambling Authority. In 2024, investigative YouTuber Coffeezilla covered the company and noted that Hypedrop had specifically rolled out a daily free crates program — exactly the “sweepstake-style free entries” move from the table above — to argue to the Danish regulator that the platform wasn’t gambling. Hypedrop’s FAQ was updated to state plainly that it is not a casino, lottery, or betting product.
The Danish Gambling Authority was not convinced. As of mid-2026, Hypedrop is geo-blocked from Denmark. The playbook didn’t fail because the structure was wrong — it failed because the regulator decided to look at the substance of the product rather than its terms-of-service. If you’re thinking about this niche as an operator: assume regulators eventually do this. The structure buys you time and ambiguity; it doesn’t buy you immunity.
Crypto-only withdrawals are legal cover, not a UX choice
Almost every site in the high-signal list above lets you deposit fiat but only withdraw to crypto or to physical product. LuxDrop, Cases.gg, Rillabox, Jemlit, EmpireDrop, MrLoot, Lootbox.com, PackDraw — all crypto-out, no fiat off-ramp. The exceptions stand out precisely because they’re rare: EarnLab accepts fiat withdrawals via PayPal because its whole GPT framing depends on coins having “no real-world value” (which is harder to argue if you also offer no withdrawal at all).
The reason isn’t user demand. It’s that “you can cash out to a bank account” is the single fact regulators look for when they want to call a platform gambling. Crypto withdrawals are a step removed — you receive a token, what you do with it next isn’t the operator’s problem. It’s a small distance legally, but it’s enough distance to matter.
The VAT tell — and Cyprus as an openly-discussed tax haven
One of the more interesting tells across the niche is how few of these high-revenue operators hold a public Cyprus VAT ID. The reason isn’t accidental: registering for VAT would force the company to formally classify what it sells as goods or services delivered inside the EU, which in turn opens the door to gambling-classification questions and EU-level audits. So most don’t register, and rely on the offshore-flavoured “we’re delivering a chance-based digital service” framing instead.
This is also one of the few parts of the playbook that operators talk about openly. In our conversations and across the community, Cyprus is referenced almost casually as a tax-friendly base — the 12.5% rate, the IP Box, the non-dom regime for founders moving there, the fintech ecosystem. There’s none of the cloak-and-dagger you’d associate with classic offshore jurisdictions. Whether that openness will last as the regulatory temperature rises is a separate question.
The one outlier worth knowing: Hypedrop’s Belize parent
Hypedrop is the structural odd-one-out. The main site sits under Plutonomy Limited, registered in Belize, with a Cyprus Ltd (Omnifarious Services Limited, Nicosia) handling the payments side. The parent is Ancient Gaming, the same group behind EyE and VIILines.
The logic is the same as the Cyprus + Delaware combo — a “loose” jurisdiction at the top for the actual game-running entity, a “tighter” jurisdiction underneath for the parts that have to interface with banks and processors — but with a Belize-shaped twist on the top half. Whether it’s overcomplex or appropriately layered depends on the operator’s appetite for offshore optics; we’d rather describe it than judge it.
Structure isn’t a moat
The temptation when looking at this playbook is to read it as a defensive moat — “the operators who survive are the ones who structured themselves right”. The history doesn’t support that. Lootie ran on a clean enough setup and stopped fulfilling deliveries before quietly dying in 2025. HypeLoot was wired through Abacanes LTD, with Fidesta Limited as the CySEC-licensed administrative service provider, and still managed to defraud users of roughly $2 million before shutting down in October 2025. BOXY.gg had a polished Cyprus-flavoured operation and is now ceased. Hybe pioneered the entire “no-loss” framing the rest of the niche now uses, and Hybe itself is also gone.
The pattern these failures have in common isn’t a structural defect. It’s user trust burning out — withdrawal complaints, fulfillment failures, the operator’s name becoming a search-term suffixed with “scam”. A clean Cyprus Ltd and a Delaware LLC won’t save you from any of that. The structure buys you the right to operate. Earning user trust over time is a separate workload, and the operators still standing are the ones who treat that workload as the actual product.
A note on responsible play
If you’re reading this as a prospective operator, the last thing worth being honest about: mystery boxes carry real risk for users. The XP-no-loss framing and the free-play layers are useful legal posture, but the engagement loop underneath is the same loop that powers any other chance-based product. Operators who succeed long-term in this niche tend to be the ones who build in spend caps, cool-off periods, and clear withdrawal paths even when they’re not legally required to. GambleAware is the standard reference point our team uses; it’s not legal advice, but it’s the floor for thinking about user welfare.
Final note: we’re not lawyers
Everything above is descriptive. It’s what we have seen on operator sites, in company registries, in ToS pages, and in our conversations with people running these platforms. It is not legal advice, it is not tax advice, and it is not a recommendation to copy any of these structures. Jurisdictions change their stance on this niche regularly — what works in Cyprus in 2026 may not work the same way in 2027. If you’re seriously considering operating in this space, talk to a real lawyer in your target jurisdiction and a real tax advisor in the one where you plan to incorporate. We’re a magazine; do your own research.
If you’re thinking about partnering rather than competing — that’s what we actually built BetterChecked for. We track the operator landscape close enough to know which structures are still standing and which are quietly going under. Get in touch via the homepage if that’s interesting.
About the authors of this this post
This article was written, checked and verified by multiple authors to ensure maximum accuracy and up to date data. With our combined 12 years of experience within the mystery box and subscription box industry, we strive for providing the best and most helpful resources about mystery boxes available.
Methodology
Every recommendation in this article comes from hands‑on experience. Our team unboxes, tests, and screenshots each mystery or subscription box under real‑world conditions. Drafts undergo expert fact‑checking by niche‑specific reviewers. We publish complete cost‑of‑goods and delivery‑timeliness data, disclose affiliate relationships, and reference only verifiable third‑party sources. We regularly cross‑match claims against peer‑reviewed research. We strive to stay transparent, accurate, and customer‑centric. If you find any errors, please reach out to us or comment above.
Editorial Policies
We use an AI-assisted approach to create content. This content is written by humans, for humans. Some parts of the content – text, images or videos – may be created by AI, but reviewed by our human experts before publishing. Read more about it in our Editorial Policies .
Ad Disclosure
Some links on this page are affiliated. Our opinions and ratings are not influenced by any other party. In order to provide fair reviews, we reach out to providers before publishing. Usually we receive an affiliate link in this process and earn commissions if you make purchases through these links. Read more in our Affiliate Disclosure .
Tell us what you think Hot!
No login required to comment • Share your experience so we can update our review