Malware Campaign Focused on Cryptocurrency Wallets
Malware concealed inside downloadable games allegedly harvested credentials that attackers used to enter cryptocurrency accounts and remove victims’ digital assets. Local 10 News first reported the case on July 15, citing a 15-page federal criminal complaint that outlined the alleged malware scheme.
The complaint alleges that the operation ran from May 2024 through February 2026, compromising roughly 8,000 devices through eight infected games. Federal investigators accuse Zyaire Dontaevious Zamarion Wilkins, 21, of North Lauderdale, Florida, of providing financial support for the malware operation and helping promote the campaign.
Hidden Malware Spread Through Video Games
Court documents describe software embedded inside eight games that allegedly collected passwords, wallet credentials, browser data, and other sensitive information after victims installed the titles. Authorities estimate the stolen information ultimately enabled unauthorized access to approximately 80 cryptocurrency wallets.
Although investigators did not identify the distribution platform by name, details in the complaint point to Steam. The FBI is gathering information from potential victims of its Steam malware investigation, including people who downloaded BlockBlasters, Chemia, Dashverse/DashFPS, Lampy, Lunara, PirateFi, Tokenova, or other games associated with the case.
Security researchers previously identified wallet-stealing malware inside PirateFi before Steam removed the title, illustrating how cybercriminals can abuse legitimate gaming marketplaces to distribute malicious software at scale. PirateFi’s removal from Steam highlighted the growing threat of malware hidden inside game downloads.
Automated Bots Helped Identify Crypto Holders
Discord, Telegram, X, and LinkedIn allegedly became marketing channels for the infected games, while automated bots reportedly searched online communities for people with significant cryptocurrency holdings. The targeted account holders then received customized messages encouraging them to install the software.
After infecting a device, the malware allegedly searched for login credentials, cryptocurrency wallet information, and authentication data. Investigators maintain that members of the conspiracy examined the stolen files and identified wallets they could access and drain.
Bitcoin and Gift Cards Created a Digital Trail
Encrypted Signal conversations allegedly showed Wilkins using the handle “Sibel.eth” while communicating with the suspected primary malware developer. According to the complaint, those exchanges included discussions about purchasing a $10,000 remote access trojan and conducting campaigns designed to empty victims’ cryptocurrency wallets.
Bitcoin transactions linked to the alleged operation eventually led investigators to Bitrefill, where more than 150 digital gift cards were allegedly purchased using cryptocurrency tied to the scheme. Most were redeemed for Uber Eats orders, and subpoenaed records connected deliveries to Wilkins’ university addresses and his South Florida residence.
Agents executing a search warrant recovered electronic devices and three cryptocurrency wallet seed phrases, including one allegedly associated with a Monero wallet.
Transaction records reviewed by authorities allegedly showed that Wilkins sent or received approximately $382,000 in cryptocurrency. He now faces one count of conspiracy to obtain computer information for private financial gain, an offense carrying a maximum sentence of 10 years in prison.
