Federal agents have arrested Zyaire Dontaevious Zamarion Wilkins, 21, of North Lauderdale, Florida, on charges related to a scheme that injected crypto-stealing malware into online video games. The FBI accuses Wilkins of helping orchestrate attacks that compromised nearly 8,000 devices and drained cryptocurrency wallets between May 2024 and February 2026.
Malware hidden in online games
According to a federal complaint, Wilkins and associates launched several modified video games laced with malicious software. The group allegedly promoted these games—named PirateFi, BlockBlasters, Dashverse, and Lunara—through online platforms like Discord, Telegram, X, and LinkedIn.
While the complaint does not mention a specific gaming platform, the listed titles were previously identified by the FBI’s Seattle office in connection with an investigation into malware distributed via Steam. Steam is a prominent digital distribution service owned by Valve Corporation and headquartered in Bellevue, Washington.
The FBI stated that the group used bots to identify potential victims with significant cryptocurrency holdings and encouraged them to download the malicious games. Once installed, the malware stole login credentials and private data, enabling the perpetrators to access around 80 cryptocurrency wallets and steal at least $220,000.
Mini dictionary: Steam is a widely used digital gaming distribution platform managed by Valve, allowing users to download, purchase, and play a wide variety of games. It also hosts a large online community and provides tools for game developers.
Investigators reported that after players installed games flagged in the case, info-stealing malware harvested private data and account credentials, giving the conspirators direct access to digital wallets and other sensitive profiles.
Investigation leads and evidence
Wilkins allegedly worked under the handle “Sibel.eth” and collaborated with a still-unidentified primary developer using the encrypted messaging app Signal. According to the complaint, the pair exchanged messages about launching “draining campaigns” and ways to fool victims into authorizing transactions that emptied their wallets instantly.
The FBI stated that Wilkins purchased a $10,000 remote access trojan to support the malware scheme. Agents ultimately tracked cryptocurrency transactions from wallets linked to the operation to the gift card service Bitrefill, which was used to buy over 150 gift cards, mainly for Uber Eats.
Subpoenas sent to Uber connected these gift cards to orders delivered to Wilkins’ home in North Lauderdale and to addresses associated with the University of West Florida, further strengthening the case against him.
| Malicious Game | Estimated Players Impacted | Funds Stolen |
|---|---|---|
| PirateFi | 7,000+ | Undisclosed |
| BlockBlasters | Hundreds | $150,000 (including $32,000 from one incident) |
| Dashverse, Lunara | Undisclosed | Part of total $220,000 |
Public warnings and next steps
This appears to be the first criminal charge stemming from an earlier FBI warning in March 2026, when the agency urged gamers affected by malicious Steam titles to come forward. The targeted games were sold as genuine products, sometimes attracting thousands of players before being identified and removed from the platform.
PirateFi alone attracted more than 7,000 players while presenting itself as a free survival game. Valve ultimately removed the game and advised affected users to reformat their computers to remove lingering malware.
BlockBlasters became notorious for stealing $32,000 from a streamer raising funds for cancer treatment during a live broadcast in September. It is believed that the title was responsible for a total of $150,000 lost by various users.
Researchers have continued to detect malware embedded in content distributed through Steam, including wallpapers on the Steam Workshop, targeting individuals holding cryptocurrencies.
Wilkins is charged with conspiracy to obtain information by computer for private financial gain, a charge that carries a maximum sentence of 10 years in prison. He appeared in federal court in Fort Lauderdale on Wednesday, though no date has been set for his transfer to Seattle, where the case will be prosecuted.
