Steam Games Used as Trojan Horse: FBI Arrests 21-Year-Old in $220,000 Crypto Theft

Dateline: Seattle, WA – The FBI arrested 21-year-old Washington resident Zyaire Wilkins on charges of computer fraud, wire fraud, and money laundering, alleging he used malicious Steam games to infect over 8,000 devices and steal more than $220,000 in cryptocurrency. The indictment, unsealed this week in the Western District of Washington, reveals a methodical operation that exploited gaming platform trust and a no-KYC gift card service to cash out. According to court documents, between May 2024 and February 2026, Wilkins uploaded at least eight games to the Steam store, each embedded with malware designed to extract sensitive data from infected computers. The malware specifically targeted cryptocurrency wallet files, private keys, clipboard contents, and browser-stored credentials. The FBI identified that the malicious code was not a novel zero-day exploit, but a classic information-stealer (infostealer) repurposed for a new delivery vector: mainstream gaming. "This case reminds us that the weakest link in crypto security is not the blockchain—it’s the endpoint," said FBI Special Agent in Charge Richard Collodi during a press conference. "Attackers are no longer relying on phishing emails alone; they’re piggybacking on trusted platforms to lower user defenses." The investigation began when multiple users reported unauthorized transactions from non-custodial wallets after downloading obscure free-to-play games on Steam. Initial forensics linked the incidents to a single command-and-control (C2) server. Agents traced the IP address back to a residential address in Washington, which matched utility records for Wilkins. But the break came from an unexpected source: food delivery. Wilkins allegedly used proceeds from stolen crypto to purchase more than 150 gift cards through Bitrefill, a platform that allows users to buy vouchers with cryptocurrency without identity verification. Court filings detail how he spent the cards on Uber Eats, Amazon, and other services, leaving a digital paper trail. FBI analysts cross-referenced Uber Eats delivery timestamps with the gift card redemption logs, confirming that the orders were delivered to his apartment. "The defendant believed that converting stolen crypto to gift cards would sever the link to his identity," said Assistant U.S. Attorney Mia Torres. "But every transaction on the blockchain is permanent. We followed the money from the victims’ wallets to the gift card platforms to the goods delivered to his door." The malware itself was rudimentary but effective. It scanned local directories for common wallet files (e.g., wallet.dat for Bitcoin, keystore files for Ethereum) and then transmitted them to the C2 server. It also monitored clipboard content to intercept copied addresses, a classic "clipboard hijacking" technique. The FBI estimated that over 8,000 machines were compromised, with losses totaling approximately $220,000—a relatively modest sum compared to DeFi hacks, but devastating for individual victims. "This isn’t about breaking smart contracts or exploiting liquidity pools," noted Jacob Smith, founder of a copy trading community who reviewed the case details. "It’s about social engineering wrapped in code. The attacker didn’t need to be a genius—he just needed to get users to click ‘Install’ on a game that looked innocuous." Wilkins is charged with one count of computer fraud (violating 18 U.S.C. §1030), one count of wire fraud, and one count of money laundering. Each charge carries a maximum sentence of 20 years in prison. He is currently detained pending a detention hearing scheduled for August 1. The case raises uncomfortable questions about platform responsibility. Steam’s parent company, Valve, has a review process for game submissions, but it primarily checks for executable exploits rather than data theft capabilities. Industry analysts estimate that less than 5% of submitted games undergo a thorough code audit. "Valve is caught between fostering an open developer ecosystem and policing bad actors," said cybersecurity researcher Lena Park. "Malware that exfiltrates files doesn’t crash the game—it runs silently in the background. Standard automated scans often miss it." In response to the indictment, a Valve spokesperson stated: "We have zero tolerance for malicious content on Steam. We removed the offending games as soon as they were reported and have improved our malware detection systems. We are cooperating fully with law enforcement." The use of Bitrefill also spotlights a regulatory gap. The platform currently does not require Know-Your-Customer (KYC) documentation for small transactions, making it a magnet for money laundering in the crypto space. While Bitrefill’s terms of service prohibit illegal use, enforcement is largely reactive. This case may prompt the Financial Crimes Enforcement Network (FinCEN) to classify such services as money transmitters, requiring stricter compliance. But experts caution that even if Bitrefill is regulated, criminals will simply migrate to other anonymous voucher providers or cut out fiat on-ramps entirely by swapping directly for privacy coins like Monero. "The cat-and-mouse game continues," said Smith. "Every time enforcement closes a door, attackers find a window. The real defense is user behavior: never run unknown executables on a machine that holds private keys, and always use hardware wallets." The FBI demonstrated that chain analysis tools—likely from firms like Chainalysis or TRM Labs—can successfully connect on-chain activity to off-chain identity when the attacker makes mistakes. In this case, the mistake was ordering Uber Eats to a personal address. "If Wilkins had used a VPN, a Monero wallet, and a dead drop for the gift cards, the trail would have gone cold," noted a former FBI cyber agent who spoke on condition of anonymity. "But 21-year-olds rarely have the discipline of a state-sponsored hacker." The indictment also alleges that Wilkins attempted to obscure his IP address using a commercial VPN service, but that the VPN provider’s logs—subpoenaed by the FBI—revealed his real address. This highlights a recurring theme in crypto crime: the false sense of security provided by anonymization tools that are still subject to legal process. For the broader crypto community, the case serves as a stark reminder that self-custody is a double-edged sword. While owning one’s keys eliminates counterparty risk, it also means that endpoint security becomes the sole barrier between assets and theft. Hardware wallet sales have historically spiked after similar incidents, but mass adoption remains slow. "Pain is just tuition," wrote Smith in a recent community post. "I paid in full so you don’t have to. The $220,000 here is a drop in the bucket compared to what you’d lose if your seed phrase gets scraped by a game mod. Protect your endpoint. Full stop." As of press time, no trial date has been set. The U.S. Attorney’s Office for the Western District of Washington declined to provide additional comments beyond the press release. This case will likely be cited in future debates about gaming platform liability and the need for mandatory developer identity verification. It also underscores the importance of law enforcement collaboration with blockchain analytics providers. For now, the message from the DOJ is clear: if you use crypto for crime, expect the blockchain to talk. And if you order pizza with stolen funds, don’t have it delivered to your house.