NORTH LAUDERDALE, Fla. \u2014 Federal agents arrested a South Florida man on Tuesday, accusing him of participating in a video game malware conspiracy in which dozens of unsuspecting victims lost six figures worth of cryptocurrency after downloading infected games.<\/p>\n
In a 15-page federal criminal complaint, FBI agents said Zyaire Dontaevious Zamarion Wilkins, 21, of North Lauderdale, financed and procured the malware and then helped market the infected games, which were distributed on a \u201cpopular digital distribution software company.\u201d<\/p>\n
That company is not directly named in the complaint, but information contained within strongly suggests that it was the platform Steam, one of the largest of its kind.<\/p>\n
Games identified in the complaint \u2015 including BlockBlasters, Dashverse, Lunara and PirateFi \u2015 were named in a plea for victim information<\/a> in a \u201cSteam malware investigation\u201d by agents in FBI\u2019s Seattle office. The case against Wilkins and others involved is being prosecuted in Seattle federal court and Steam\u2019s parent company, Valve Corporation, is based in nearby Bellevue, Washington.<\/p>\n Agents said in the scheme, Wilkins and others \u201cgained unauthorized access to approximately 80 cryptocurrency wallets and stole cryptocurrencies worth at least $220,000\u2033 from May 2024 to this February by \u201claunch(ing) eight games embedded with malware and infect(ing) the devices of approximately 8,000 individual customers.\u201d<\/p>\n According to the complaint, Wilkins and others helped market the games on social media and messaging applications, including Discord, Telegram, X and LinkedIn and encouraged others to download them.<\/p>\n Additionally, agents said the conspirators targeted specific victims, using bots \u201cto identify individuals with large cryptocurrency holdings and send them targeted messages\u201d encouraging them to download the games.<\/p>\n \u201cAfter their victims downloaded the games, the conspirators used the malware to access and steal private user data and credentials,\u201d the complaint states. \u201c(They) went through the stolen data and identify any information that could be used to access, without authorization, cryptocurrency accounts of others and steal cryptocurrencies from their victims.\u201d<\/p>\n Wilkins, believed to be a student at the University of West Florida, used the handle \u201cSibel.eth\u201d online, according to the complaint, which he used to communicate with the \u201cprimary developer\u201d of the programs.<\/p>\n That person is not identified in the complaint.<\/p>\n Agents said after executing a search warrant on the primary developer\u2019s home and seizing devices, they found chats with \u201cSibel.eth\u201d on the encrypted messaging platform Signal showing a \u201chigh level of collaboration\u201d between the two.<\/p>\n They said that the chats showed that Wilkins bought a \u201cremote access trojan\u201d program for $10,000. <\/p>\n The primary developer and Wilkins also \u201cexchanged messages about a criminal scheme in which they would run \u2018draining campaigns\u2019 regarding cryptocurrency wallets\u201d and the two discussed \u201ctricking victims into authorizing transactions that instantly empty their wallets,\u201d according to the complaint.<\/p>\n Authorities said they were to identify \u201cSibel.eth\u201d as Wilkins by tracing cryptocurrency payments sent from the scheme\u2019s Bitcoin wallet to Bitrefill, an online service which was used to purchase over 150 digital gift cards that were predominantly for Uber Eats.<\/p>\n An FBI subpoena to Uber revealed that those cards were linked to an account that had deliveries at Wilkins\u2019 UWF addresses as well as at Wilkins\u2019 home in South Florida.<\/p>\n Agents said they executed a search warrant at Wilkins\u2019 North Lauderdale home last Wednesday. He \u201crefused to speak with law enforcement,\u201d they said.<\/p>\n According to the complaint, investigators seized multiple devices as well as \u201cthree cryptocurrency wallet seed phrases<\/a>.\u201d<\/p>\n \u201cOne of the seed phrases is for a Monero wallet, an anonymity-enhanced cryptocurrency frequently used by criminals that is difficult to trace between source and destination,\u201d an agent wrote in the complaint. \u201cBased on my training and experience, I know that cybercriminals use Monero to enhance anonymity and the difficulty in cryptocurrency transaction attribution for law enforcement.\u201d<\/p>\n A review of Wilkins\u2019 crypto transaction history showed he sent or received $382,000, according to the complaint.<\/p>\n