Every Denuvo Game Cracked, So 2K Demands Check-Ins

On April 27, a community-maintained Reddit list tracking Denuvo-protected single-player games hit a number nobody expected to see: zero. Every single game on the list had been cracked or bypassed. It took years of work, a kernel-level hypervisor bypass, and a collective of hackers who refused to quit. And the publisher response, at least from 2K Games, has been swift and predictable: if you can't stop pirates, punish everyone.

According to reports from Pirat Nation on X and Tom's Hardware, 2K and Denuvo have teamed up to add mandatory 14-day online check-ins to several PC titles. NBA 2K25, NBA 2K26, and Marvel's Midnight Suns now reportedly use a "fixed offline authorization token" that expires every two weeks. When the timer runs out, the game refuses to launch until you connect to the internet and let it phone home to Denuvo's servers for a fresh token. If you're offline, you're locked out. Even if you bought the game at full price.

The milestone that triggered this was the work of the MKDev collective and a modder known as DenuvOwO, who developed a hypervisor-based bypass (HVB) that installs a driver at the kernel level to intercept and respond to Denuvo's security checks. It's not a traditional crack; Denuvo's code is technically still in the game, it just doesn't function anymore. The bypass has been refined over time, too. Earlier versions required users to disable multiple layers of Windows security, but the latest iteration only requires turning off Core Isolation, which is still risky but a much lower barrier than before.

The collateral damage

Here's what frustrates me about the 14-day check-in: it does nothing to address the actual bypass. Pirates will keep iterating. The HVB can't replicate a server call-and-response, so this specific measure does block the current bypass method. But the people most affected aren't pirates. They're paying customers who travel, who play on a Steam Deck without Wi-Fi, or who simply don't have a reliable internet connection. Requiring an online check every two weeks for a single-player game is treating legitimate buyers as suspects.

Pirat Nation's post also claims the 14-day requirement isn't clearly disclosed on the affected games' Steam store pages or in their EULAs. If that's accurate, players bought these games under one set of terms and had the rules changed on them after the fact. Multiple outlets have reached out to 2K for comment, with no response at the time of their reporting.

This also lands in the same week that PlayStation reportedly added 30-day DRM timers to new digital PS4 and PS5 purchases, a move Sony still hasn't officially confirmed despite growing player complaints. The timing makes the whole thing feel less like isolated decisions and more like an industry-wide lurch toward treating digital ownership as a revocable license. Which, look, it technically always has been under most EULAs, but there's a difference between the legal fine print and actively enforcing expiration timers on games people already own.

The irony is thick. Denuvo's reputation among PC players was already terrible before any of this. Games like Resident Evil Requiem have reportedly seen performance improvements when the bypass is applied, which means paying customers are getting a worse experience than pirates. That's been the core complaint about Denuvo for years, and nothing about a 14-day check-in fixes it. If anything, it makes the argument for bypassing Denuvo more, not less.

Some studios have already figured out that distancing themselves from Denuvo is good PR. InZoi dropped it after fan backlash during its trial version. Kingdom Come: Deliverance 2 shipped without it. When removing DRM becomes a marketing advantage, that should tell publishers something about how players view the technology.

I don't think piracy is consequence-free, and I understand why publishers want to protect launch-window sales. But 2K's response here is reactive and poorly targeted. The games reportedly affected include Marvel's Midnight Suns, a title that launched in late 2022 and has been on deep discount for ages. Slapping a 14-day leash on a game that old isn't protecting revenue; it's making a point. And the point it makes is that 2K would rather inconvenience its paying customers than accept that Denuvo, as a deterrent, has failed. If more publishers follow this path, the list of reasons to buy DRM-protected games on PC gets shorter, not longer.