FBI arrests Steam malware creator who stole $220,000 from players

The FBI arrested 21-year-old Florida student Zyaire Wilkins this week, accused of building and distributing five malware-laden games on Steam. The federal investigation found the games infected computers, stole passwords, and drained victims' cryptocurrency wallets for nearly two years before anyone caught on. Wilkins didn't need to be a genius to pull this off. He just needed to find the gap Steam has had for years: the platform checks a game for malware once, at first submission, and barely touches the subject again on later updates.

How the scheme worked

The five games Wilkins and his associates published on Steam looked and played like ordinary, finished releases, players could install and run them without issue. In the background, though, they installed malware that harvested passwords and browser data, then searched local drives for cryptocurrency wallet files. The games were marketed on Discord, LinkedIn, and Telegram, and prosecutors say the conspirators also used bots to identify people with large crypto holdings and send them targeted messages pushing a specific game.

This wasn't a single lucky trick. The scheme ran from May 2024 to February 2026, nearly two years during which five separate titles passed through Steam's system undetected.

The victim that hits hardest

Among the losses the investigation uncovered, one stands out: BlockBlasters was used to steal $32,000 a streamer had raised for cancer treatment costs. That wasn't an anonymous crypto investor losing speculative savings, it was money viewers donated with a specific, sick person in mind. That single case shows how far the real victim profile here sits from the stereotype of "a gamer who got played."

How the FBI tracked him down

The investigative method behind the arrest was more mundane than sophisticated digital forensics. Agents traced the cryptocurrency payments used to buy gift cards, then subpoenaed Uber for delivery account data tied to those transactions. Matching a courier account to the online handle "Sibel.eth," which Wilkins used online, was enough to identify him as a suspect. The FBI had been investigating since March 2026, when it first asked victims to come forward with evidence, and it says unidentified co-conspirators may still be involved.

Why Steam let this run for so long

The core of the problem is how Valve approaches malware screening. Scanning happens when a title is first submitted to the store, but later updates to that same game don't go through comparably thorough checks. For anyone looking to smuggle in malware, that leaves a simple opening: ship a clean, working version of the game first, pass review, then add the malicious code in a later update once moderators are paying less attention. The pattern wasn't unique to Wilkins' games, either: other infected titles like Chemia and Beyond the Dark got pulled from Steam around the same period, which suggests the gap isn't a one-off oversight but a structural weakness in the system.

SPAWNSY verdict