US federal authorities have arrested a 21-year-old Florida man accused of participating in a scheme that allegedly used malware hidden inside video games distributed through Steam to steal more than $220,000 worth of cryptocurrency from users.
According to a criminal complaint, Zyaire Wilkins and several alleged co-conspirators are accused of launching and promoting eight malware-infected games between May 2024 and February 2026. Investigators allege the campaign compromised around 8,000 devices and enabled the theft of funds from approximately 80 cryptocurrency wallets.
While the complaint does not explicitly state that the titles were uploaded to Valve's Steam platform, the investigation appears to centre on Steam. The FBI had previously appealed for information from potential victims as part of what it described as a "Steam malware investigation", naming games including BlockBlasters, Chemia, Dashverse (also known as DashFPS), Lampy, Lunara, PirateFi and Tokenova.
Several of the games had already attracted attention after being removed from Steam last year. Reports at the time linked BlockBlasters to cryptocurrency theft exceeding USD 150,000, including losses suffered by a content creator who was raising funds for cancer treatment.
Prosecutors allege that Wilkins and his associates promoted the malware-laden games across social media and messaging platforms, including Discord, Telegram, X and LinkedIn, encouraging users to download and play them. Once installed, investigators claim the malware enabled the group to collect sensitive information from victims and gain access to their cryptocurrency wallets.
Federal investigators identified Wilkins through cryptocurrency transactions linked to communications with an alleged co-conspirator. According to the complaint, authorities traced a cryptocurrency wallet to an account on Bitrefill, a platform that allows users to purchase gift cards using cryptocurrency.
Investigators allege the account purchased more than 150 gift cards, including Uber Eats vouchers. Authorities said those transactions helped them identify a phone number associated with the account, ultimately leading to Wilkins' address.
