Security Privacy Coins

How the FBI Traced a $220K Steam Malware Scheme Through Google Cookies and Uber Eats Orders

2026-07-25

The FBI arrested 21-year-old Zyaire Dontaevious Zamarion Wilkins of North Lauderdale, Florida on July 14, 2026, and charged him with conspiracy to obtain information by computer for private financial gain. Wilkins allegedly helped run an operation that embedded malware in eight video games, infected around 8,000 devices, and stole at least $220,000 from roughly 80 cryptocurrency wallets between May 2024 and February 2026.

The games themselves—BlockBlasters, Dashverse, Lunara, PirateFi, Chemia, Lampy, DashFPS, and Tokenova—looked legitimate enough. All were removed from Steam in early 2026. But they contained infostealer malware designed to harvest passwords, session tokens, and crypto wallet data. The group promoted them on Discord, Telegram, X, and LinkedIn, using bots to identify targets with large holdings and send targeted messages encouraging installation.

Wilkins didn't write the code or upload the games himself. Instead, he operated under a Signal account identified as "Sibel.eth," provided funding, and orchestrated the scheme. Agents found conversations in which he offered a budget of about $10,000 for a remote access Trojan. Blockchain records showed approximately $10,000 transferred to the supplied Bitcoin address the same day.

What makes this case remarkable is how the investigators cracked it. The key wasn't some forensic breakthrough on the blockchain—it was far simpler. Wilkins converted stolen crypto into over 150 Bitrefill gift cards. Then he spent most of them on Uber Eats. The digital equivalent of pulling off a heist and leaving the receipt on the vault floor.

The trail ran like this: cryptocurrency payments to Bitrefill, a service that sells gift cards for crypto. Investigators subpoenaed Uber, matched the cards to an account, and found deliveries going to Wilkins' family home and his addresses at the University of West Florida. Over 500 food-delivery orders between March 2024 and May 2026, spending over $9,000, all went to one of three locations. Deliveries to the university addresses clustered during class sessions. Orders outside those windows went to his family address. The consumption pattern itself became evidence.

Each data point formed a chain: email addresses, phone numbers, Google cookies, Snapchat accounts, T-Mobile records. They all linked that anonymous cryptocurrency account to a real person and known addresses.

When agents searched the North Lauderdale house a week before the arrest, they seized several devices and three cryptocurrency wallet seed phrases. One belonged to a Monero wallet. Wilkins' transaction history showed $382,000 in cryptocurrency sent or received—a figure that reflects cumulative activity, separate from the alleged victim-loss estimate of at least $220,000.

Monero is privacy-focused cryptocurrency. An FBI agent described it in the complaint as "frequently used by criminals" because it's difficult to trace. But here's the catch: even privacy-focused holdings cannot survive a direct search warrant. Investigators obtained the Monero evidence after executing the residential search, using a seized seed phrase rather than attempting to trace Wilkins through Monero's public transaction history.

The case cuts both ways. It shows the risks of major software platforms as attack vectors. It also exposes the practical limitations of cryptocurrency privacy. By cashing out through consumer-facing services, the scheme created the exact metadata trail that law enforcement would later use to bridge anonymous online handles and physical identity.

Source & further reading:

Sources