Steam Malware Heist: $220K in Crypto Gone from 80 Wallets — Arrest Made

Crypto holders are accustomed to guarding against exchange hacks and phishing scams, but this arrest reveals a stealthier threat: malware delivered through curated gaming platforms like Steam. By embedding a remote access Trojan in seemingly safe game downloads, attackers bypassed security tools and directly targeted wallet files, illustrating how DeFi participants must now scrutinize every facet of their digital life.

Federal agents arrested 21-year-old Zyaire Dontaevious Zamarion Wilkins on July 14, 2026, in North Lauderdale, Florida, charging him with conspiracy to obtain information by computer for private financial gain. The case, prosecuted near Valve’s Bellevue headquarters, marks a breakthrough in an FBI investigation into a Steam-based malware campaign that siphoned at least $220,000 in cryptocurrency from unsuspecting gamers. Wilkins faces up to 10 years in prison under the Computer Fraud and Abuse Act if convicted.

“

The case, prosecuted near Valve’s Bellevue headquarters, marks a breakthrough in an FBI investigation into a Steam-based malware campaign that siphoned at least $220,000 in cryptocurrency from unsuspecting gamers.

The scheme operated between May 2024 and February 2026, distributing eight malicious games through what a federal complaint describes only as “a popular digital distribution software company.” The titles—BlockBlasters, Dashverse, Lunara, PirateFi, and several others—were all subsequently removed from Steam and flagged as suspicious in SteamDB archives. According to investigators, Wilkins and his co-conspirators embedded a remote access Trojan (RAT) into these games, which Wilkins allegedly purchased for $10,000. Once installed, the malware granted attackers remote control over victims’ devices, allowing them to scan for and exfiltrate cryptocurrency wallet data.

The campaign infected approximately 8,000 individual devices and compromised around 80 crypto wallets. Although the total haul of $220,000 is modest compared to billion-dollar exchange hacks, the attackers deliberately targeted specific individuals known to hold significant cryptocurrency balances, demonstrating a shift from broad phishing to surgical, high-yield attacks on retail holders. The FBI’s Seattle field office publicly referenced Steam in a March 2026 victim-information request, directly linking the platform to the investigation, though Valve itself has not been formally named in court documents.

The arrest follows a classic malware-as-a-service pattern: a buyer (Wilkins) purchased a pre-built Trojan, leveraged a trusted distribution channel (Steam), and monetized access through crypto theft. The longevity of the operation—nearly two years—raises questions about Steam’s game review processes and the ability of automated systems to detect sophisticated malware. For the cryptocurrency community, the incident underscores the vulnerability of software (hot) wallets on everyday devices, and the emerging risk of gaming platforms becoming attack vectors. Security experts advocate the use of hardware wallets or air-gapped devices for any meaningful holdings.