Federal arrest over crypto-stealing malware hidden in eight playable Steam games

Crypto-stealing malware hidden in playable Steam games led to a federal arrest in Florida on July 14, 2026.

Zyaire Wilkins, 21, of North Lauderdale, is accused of conspiring with others to publish eight malware-laced games on a major digital distribution platform, including BlockBlasters, Dashverse, Lampy, Lunara and PirateFi.

What the complaint alleges

According to a criminal complaint filed in the Western District of Washington, the malware infected around 8,000 devices between May 2024 and February 2026. It stole passwords and data, and was used to access roughly 80 crypto wallets for at least $220,000.

Wilkins is charged with conspiracy to obtain information by computer for private financial gain and faces up to 10 years if convicted. He has not entered a plea and is presumed innocent.

The Uber Eats trail

The investigative detail is the part worth remembering. Agents say they followed the stolen bitcoin to more than 150 digital gift cards, most of them spent on Uber Eats. They then subpoenaed Uber and matched the delivery addresses to Wilkins.

Crypto’s supposed anonymity ended at a food delivery doorstep. Whatever laundering happened on-chain, the physical world keeps records too, and delivery addresses are about as identifying as records get.

The old lesson holds

The attack itself was not sophisticated social engineering. It was playable games, downloaded voluntarily, from a mainstream platform, carrying a payload. Free download, real wallet, no separation between the two.

For anyone holding crypto, the practical takeaway has not changed in a decade: the machine you game and browse on should not be the machine that holds your keys. Around 8,000 people found that out the hard way over two years. If your wallet lives on the same device as your downloads folder, this case is a good reason to go check your wallet hygiene.