Malware in Steam Games Took $220,000 From 80 Crypto Wallets

Federal investigators say a scheme that hid malware inside downloadable video games compromised roughly 8,000 devices and drained at least $220,000 from 80 cryptocurrency wallets. The FBI is now seeking potential victims as it builds its case.

The malware was concealed inside eight games and allegedly collected passwords, wallet credentials, browser data, and other sensitive information after victims installed the titles. The stolen credentials allowed attackers to enter cryptocurrency accounts and transfer digital assets, according to a 15-page federal criminal complaint. Local 10 News first reported the case on July 15.

Authorities accuse Zyaire Dontaevious Zamarion Wilkins, 21, of North Lauderdale, Florida, of providing financial support for the operation and helping promote the campaign. The complaint alleges the scheme ran from May 2024 through February 2026. Investigators approximate that the stolen information enabled unauthorized access to about 80 cryptocurrency wallets.

Court documents say the software was embedded inside eight games. Although the complaint does not name the distribution platform, details point to Steam. The FBI is gathering information from people who downloaded titles including BlockBlasters, Chemia, Dashverse, DashFPS, Lampy, Lunara, PirateFi, Tokenova, or other games associated with the case.

Security researchers had previously identified wallet-stealing malware inside PirateFi before Steam removed the title. The case illustrates how cybercriminals can abuse legitimate gaming marketplaces to distribute malicious software at scale.

The infected games were marketed through Discord, Telegram, X, and LinkedIn. Automated bots reportedly searched online communities for people with significant cryptocurrency holdings, and targeted account holders received customized messages encouraging them to install the software. After infecting a device, the malware searched for login credentials, wallet information, and authentication data. Members of the conspiracy then examined the stolen files and identified wallets they could access and drain, investigators said.

Encrypted Signal conversations allegedly showed Wilkins using the handle “Sibel.eth” while communicating with the suspected primary malware developer. The exchanges included discussions about purchasing a $10,000 remote access trojan and conducting campaigns to empty victims’ cryptocurrency wallets, the complaint said.

Bitcoin transactions linked to the alleged operation led investigators to Bitrefill, where more than 150 digital gift cards were purchased using cryptocurrency tied to the scheme. Most were redeemed for Uber Eats orders. Subpoenaed records connected deliveries to Wilkins’ university addresses and his South Florida residence.

Agents executing a search warrant recovered electronic devices and three cryptocurrency wallet seed phrases, including one allegedly associated with a Monero wallet. Transaction records reviewed by authorities showed that Wilkins sent or received approximately $382,000 in cryptocurrency.

Wilkins faces one count of conspiracy to obtain computer information for private financial gain. The offense carries a maximum sentence of 10 years in prison.