Federal prosecutors have charged a 21-year-old Florida man with cybercrime, alleging he spent nearly two years spreading malware through video games to steal cryptocurrency. Authorities say the attacks affected around 8,000 computers and resulted in the theft of at least $220,000 from approximately 80 cryptocurrency wallets.
Last week, authorities arrested Zyaire Dontaevious Zamarion Wilkins and charged him alongside unnamed co-conspirators with several offenses, including conspiracy to distribute malware. According to the FBI, the group inserted malicious code into at least eight video games and promoted them on Discord, Telegram, X, LinkedIn, and other online platforms. Investigators also allege they used automated bots to identify users with significant cryptocurrency holdings before contacting them directly.
Investigators say the malware was designed to collect passwords and other sensitive information from infected devices. The stolen data was allegedly used to gain access to online cryptocurrency wallets and transfer funds. According to the FBI, part of the investigation involved tracing stolen bitcoin to more than 150 Bitrefill gift cards that were reportedly used mostly for Uber Eats orders.
The indictment doesn’t specify which storefront distributed the compromised games. However, the FBI complaint identifies BlockBlasters, Dashverse, Lunara, and PirateFi as titles that were available on Steam until earlier this year. The bureau had previously announced an investigation into malware spread through the platform and encouraged affected users to come forward.
Forensic cryptocurrency researcher ZachXBT and malware archive vx-underground reported that BlockBlasters accounted for approximately $150,000 of the stolen cryptocurrency, impacting an estimated 261 to 478 victims. Among them was Twitch streamer RastalandTV, who lost $32,000 in September 2025 while undergoing cancer treatment. The funds had been raised through viewer donations to assist with medical costs.
According to the FBI, Wilkins helped finance the operation and promoted the malware within underground cybercrime communities. Investigators also searched the property of a suspected malware developer and collected additional evidence. WPLG Local 10 reported that Signal messages recovered during the search linked Wilkins, who allegedly used the alias Sibel.eth, to the operation. The messages reportedly discussed the purchase of a $10,000 remote access Trojan and techniques for convincing victims to authorize fraudulent cryptocurrency transactions. The suspected developer has not been publicly named or charged.
Maybe you would like other interesting articles?