The big picture: A 21-year-old Florida resident was arrested last week for allegedly stealing more than $220,000 in cryptocurrency through malware hidden in video games. Although the indictment does not identify the storefront that hosted the infected games, it mentions several titles that were listed on Steam until recently.
The suspect, identified by the FBI as Zyaire Dontaevious Zamarion Wilkins, is accused of running a sophisticated cybercrime operation with unnamed co-conspirators for nearly two years. The group allegedly infected around 8,000 PCs by embedding malware in at least eight video games. Investigators believe they stole at least $220,000 from roughly 80 cryptocurrency wallets between May 2024 and February 2026.
The FBI charged Wilkins and his associates with several cybercrime offenses, including conspiracy to distribute malware. According to investigators, the suspects promoted the infected games on popular social media and messaging platforms such as Discord, Telegram, X, and LinkedIn. They also allegedly targeted users with large cryptocurrency holdings by identifying them with bots and contacting them directly.
The malware was designed to extract passwords and other sensitive data from victims' computers, then use that information to steal cryptocurrency from their online wallets. The FBI ultimately tracked the suspects by linking the stolen bitcoin to more than 150 Bitrefill gift cards, which were reportedly used primarily to pay for Uber Eats orders.
According to the FBI's complaint, the list of infected games includes BlockBlasters, Dashverse, Lunara, and PirateFi. All of them remained available on Steam until earlier this year, when the FBI announced it was investigating malware on the platform and urged anyone who had downloaded the infected games to come forward and assist with the investigation.
According to forensic cryptocurrency researcher ZachXBT and the online malware repository vx-underground, BlockBlasters alone accounted for roughly $150,000 of the stolen cryptocurrency from between 261 and 478 victims. That included $32,000 stolen from Twitch streamer RastalandTV in September 2025. The streamer, who was undergoing cancer treatment, had received the money as donations from viewers to help cover medical expenses.
The FBI believes Wilkins financed the entire operation and marketed the malware to underground cybercriminals. Investigators also identified the developer suspected of writing the malware and searched the individual's property for additional evidence. According to Miami news station WPLG Local 10, Signal chats recovered from the developer's devices linked Wilkins to the operation.
The messages reportedly revealed that Wilkins, who allegedly operated under the dark web alias Sibel.eth, purchased a $10,000 remote access trojan and discussed the best ways to trick victims into approving fraudulent cryptocurrency transactions. The suspected malware developer was not identified in the report and has yet to be formally charged.