FBI alleges malware hidden in eight games led to theft from 80 crypto wallets

Games used to deliver malware

According to court documents, the malicious software was concealed inside eight game titles distributed for download. After installation, the malware allegedly collected passwords, wallet credentials, browser information and other sensitive data from infected devices. Investigators say that stolen information was then used to access cryptocurrency accounts without authorization and remove funds.

Authorities estimate the campaign affected around 8,000 devices in total. The filings link the compromise of those systems to the later intrusion into about 80 crypto wallets.

Targeting crypto holders online

Investigators allege that the infected games were promoted through Discord, Telegram, X and LinkedIn. The complaint says automated bots were used to search online communities for people believed to hold significant amounts of cryptocurrency.

Those targets allegedly received tailored messages urging them to download the software. Federal authorities describe the effort as a focused campaign aimed at identifying crypto holders and steering them toward the compromised games.

Messages, payments and gift cards

The complaint also references encrypted Signal chats that allegedly show Wilkins using the handle “Sibel.eth” while communicating with the suspected lead malware developer. In those conversations, according to investigators, the parties discussed buying a $10,000 remote access trojan and running campaigns intended to drain victims’ crypto wallets.

Blockchain records are said to have provided another line of evidence. Investigators traced bitcoin transactions connected to the alleged operation to Bitrefill, where more than 150 digital gift cards were reportedly bought using cryptocurrency tied to the scheme. Most of the cards were redeemed for Uber Eats purchases, and subpoenaed records allegedly linked deliveries to Wilkins’ university addresses and a South Florida residence.

Search warrant and charges

When agents executed a search warrant, they recovered electronic devices and three cryptocurrency wallet seed phrases, including one that investigators say was associated with a Monero wallet. Authorities also reviewed transaction records that allegedly showed Wilkins sent or received about $382,000 in cryptocurrency.

Wilkins now faces one count of conspiracy to obtain computer information for private financial gain. The offense carries a maximum sentence of 10 years in prison.

The case remains at the allegation stage, and investigators have said they are looking for additional victims who may have installed the compromised games or lost funds as a result of the campaign. The filings outline a scheme centered on credential theft, targeted outreach and cryptocurrency transfers, but the full scope of losses and the number of affected users may change as the inquiry continues.