Florida man arrested in alleged game malware crypto theft scheme

Federal agents arrested a 21-year-old Florida man over an alleged video game malware operation that targeted crypto holders, according to an FBI complaint. For everyday investors, the case is a reminder that a crypto wallet can be drained through ordinary-looking software, not just fake exchange links or scam tokens.

Zyaire Dontaevious Zamarion Wilkins of North Lauderdale was arrested Tuesday and charged with conspiracy to obtain information by computer for private financial gain, according to the 15-page complaint first reported by WPLG Local 10. The charge carries a maximum sentence of 10 years in prison, according to the complaint.

The FBI alleges Wilkins and others hid malware, meaning software designed to secretly damage a device or steal information, inside online games. Between May 2024 and February 2026, the group released eight infected games, compromised about 8,000 devices, accessed roughly 80 crypto wallets and stole at least $220,000, according to the complaint.

How the alleged scheme worked

The complaint does not identify the game marketplace by name, describing it as a popular digital distribution software company. The listed titles include PirateFi, BlockBlasters, Dashverse and Lunara, which were among games flagged by the FBI’s Seattle field office in a public Steam malware investigation earlier this year. The case is being prosecuted in Seattle, near Valve’s Bellevue, Washington headquarters.

Investigators said the group promoted the games on Discord, Telegram, X and LinkedIn. According to the FBI, bots were used to find people believed to hold large amounts of crypto and steer them toward downloading the games.

Once installed, the games allegedly collected private information and login credentials. That matters in crypto because wallet access often depends on credentials or a seed phrase, a set of backup words that can restore control of a wallet. If someone else gets those words, they may be able to move the assets.

The FBI said investigators connected Wilkins to the online handle “Sibel.eth.” According to the complaint, that account communicated on Signal with an unidentified primary developer about “draining campaigns,” including efforts to get victims to approve transactions that would empty their wallets. Investigators also said Wilkins bought a remote access trojan for $10,000. A remote access trojan is malware that can let an attacker control or inspect a victim’s device from afar.

Investigators followed gift card spending

The FBI said agents traced Bitcoin from a wallet tied to the alleged operation to Bitrefill, where it was used to buy more than 150 gift cards, mostly for Uber Eats. A subpoena to Uber connected those cards to an account that received deliveries at Wilkins’ home and at University of West Florida addresses, according to the complaint.

Agents searched Wilkins’ North Lauderdale home the week before his arrest, according to the FBI. The complaint says he declined to speak with them. Investigators said they seized several devices and three wallet seed phrases, including one for Monero, a privacy-focused cryptocurrency the agent described as hard to trace and often used by criminals. A review of Wilkins’ crypto activity showed about $382,000 moving in and out, according to the complaint.

The arrest appears to be the first charge tied to the FBI’s broader investigation into malicious Steam games, which the bureau made public in March when it asked affected gamers to contact investigators. The FBI said those games appeared legitimate but installed information-stealing software that scraped wallet and account data. PirateFi attracted about 7,000 players while presenting itself as a free survival game before Valve removed it and told users to reformat their computers, according to the FBI investigation materials cited in the complaint.

This story draws on original reporting from Decrypt.