2K adds mandatory 14-day online DRM checks to NBA 2K26 and Marvel’s Midnight Suns as hackers claim Denuvo crack

NBA 2K26 and Marvel’s Midnight Suns now require players to connect online every 14 days for DRM reauthorisation, after hackers reportedly cracked Denuvo’s anti-tamper protection for single-player PC games. The Denuvo and 2K update uses new 14-day expiring authorisation tokens, which cannot be bypassed by previously released piracy exploits.

2K Games, in partnership with Denuvo, has introduced a new digital rights management (DRM) mechanism for recent PC titles, notably NBA 2K25, NBA 2K26, and Marvel’s Midnight Suns. All affected games now require players to connect to the internet and reauthorise every 14 days, following reports that Denuvo’s core DRM was fully bypassed by hackers at the end of 2025. The move comes after the game-pirating community developed a kernel-level driver bypass capable of intercepting and faking Denuvo’s security checks, which allowed pirates to release cracked, DRM-free versions of major titles on launch day.

How the new 14-day Denuvo DRM cycle works

According to Tom’s Hardware, “titles such as NBA 2K25, NBA 2K26 and Marvel’s Midnight Suns now use an authorization token, which expires after 14 days. When this token runs out, the game will not load unless players connect online again, authorise their install and get a new authorization token (at which point the 14-day timer will start again).” This approach means:

• To continue playing, a new online check is mandatory every 14 days.
• The token system directly communicates with Denuvo’s servers, making it immune to previous bypass methods that operated purely at the kernel level.
• Players without internet access at the 14-day expiry will not be able to launch affected games offline, which impacts devices like the Steam Deck and scenarios where players cannot connect regularly.

This escalation in DRM enforcement follows Tom’s Hardware’s April 2026 report that “Denuvo has essentially been blown open,” referring to the kernel-level bypass discovered by the pirating community at the end of 2025. Tom’s Hardware further stated, “It’s impossible for the Denuvo bypass to beat [the new system], because it involves a call and response to Denuvo’s actual servers.” The integration of the token refresh requirement represents a significant attempt by 2K and Denuvo to stem the release of day-one, DRM-free cracked versions of their big-budget PC games.

Implications for gamers and industry trends

Players have voiced concerns over the performance impact of Denuvo’s DRM in the past, citing routine anti-tamper checks that can degrade gameplay. The new 14-day online check intensifies those concerns, adding practical inconvenience for players who lack regular internet access or prefer to play offline. Specifically, anyone not connecting at least once every 14 days will lose access until they reconnect and reauthorise the game, a restriction that may limit play on portable devices like the Steam Deck when on the move or travelling.

In a parallel development, PlayStation is reportedly rolling out a similar DRM mechanism, with a 30-day online check now appearing on all new digital PS5 and PS4 purchases. Although Sony hasn’t formally confirmed the change, “a number of players have posted examples of new games they bought now requiring to have online checks every 30 days, or else they will become unplayable,” according to recent user reports. This trend indicates increasing industry reliance on periodic online validation as a defensive response to evolving DRM circumvention techniques.

Denuvo’s anti-tamper software has long been controversial. Some players assert the DRM lowers PC game performance, while others note that persistent online checks add to the inconvenience for legitimate buyers. The current 14-day policy for 2K’s top games marks a new escalation, blending always-online requirements with regular client authentication.

Key Facts:

• Games Affected: NBA 2K25, NBA 2K26, Marvel’s Midnight Suns (PC)
• New DRM Mechanism: 14-day expiring online authorisation tokens, requiring a fresh internet check-in to continue playing.
• Rationale: Response to Denuvo kernel-level bypass discovered by hackers.
• Bypass Status: Unbeatable by existing piracy tools, since it relies on server communication.
• Related Trend: PlayStation digital titles now reportedly include a 30-day online check requirement.

As the arms race between game publishers and piracy groups intensifies, mandatory reauthorisation checks may become the new normal for triple-A digital games, reshaping both gamer expectations and the landscape of digital rights management enforcement.