Florida Man Arrested Over Steam Malware Scheme That Stole $220,000 in Crypto

Federal agents arrested Zyaire Dontaevious Zamarion Wilkins on July 14th. The 21-year-old from North Lauderdale, Florida has been charged with conspiracy to obtain information by computer for private financial gain, a charge that carries up to ten years in prison. He was due in federal court in Fort Lauderdale the following day, with no timeline confirmed for his transfer to Washington, where the case is being prosecuted near Valve's Bellevue headquarters.

Wilkins is alleged to have been part of a scheme that ran between May 2024 and February 2026, using malware-laced games distributed through what a 15-page federal complaint describes only as "a popular digital distribution software company." The games listed – BlockBlasters, Dashverse, Lunara, and PirateFi – are amongst those previously flagged by the FBI's Seattle field office in a public Steam malware investigation earlier this year. The platform isn't named, but the connection is not difficult to make.

How 8,000 Devices Got Infected

Wilkins and others allegedly launched eight malicious games across the platform and infected roughly 8,000 devices, gaining access to around 80 crypto wallets and stealing at least $220,000 in the process. The group marketed the titles across Discord, Telegram, X, and LinkedIn, and used bots to identify users with large crypto holdings before nudging them toward downloading. Once installed, the malware harvested private data and login credentials, which the conspirators then used to access anything that could unlock a victim's accounts.

Investigators identified Wilkins through his "Sibel.eth" handle, which they say he used to coordinate with an unidentified primary developer over Signal. The two allegedly discussed running "draining campaigns" and tricking victims into approving transactions that instantly emptied their wallets. Wilkins reportedly purchased a remote access Trojan for $10,000 to facilitate the scheme. Whilst $220,000 is the figure named in the complaint, a review of Wilkins' crypto history showed roughly $382,000 moving in and out altogether.

The games used as bait had real player numbers before Valve took action. PirateFi drew around 7,000 players whilst posing as a free survival game before the platform pulled it and advised users to reformat their computers. BlockBlasters is arguably the most notable case – it drained over $32,000 from a streamer raising money for cancer treatment, live on air, last September, as part of an estimated $150,000 taken from hundreds of users over the course of the operation.

The Part Where Uber Eats Gets Involved

Investigators tracked the Bitcoin from the scheme's wallet to Bitrefill, where it had been spent on more than 150 gift cards, the majority for Uber Eats. A subpoena to Uber linked those cards to an account with deliveries recorded to Wilkins' home address and to his University of West Florida address. A $10,000 remote access Trojan, thousands of compromised devices, a scheme running for nearly two years – and the thread that unraveled it was takeaway delivery records.

When agents searched his North Lauderdale home, Wilkins refused to speak with them. Several devices were seized alongside three wallet seed phrases, one of which was for Monero – a privacy coin the investigating agent described as "frequently used by criminals" due to how difficult it is to trace. Using Monero for the wallet seed phrases whilst spending stolen Bitcoin on Uber Eats gift cards is the kind of operational security inconsistency that tends to feature prominently in federal complaints.

The arrest appears to be the first charge linked to the FBI's March investigation, when the bureau publicly asked gamers affected by the malicious Steam titles to come forward. That the platform continues to be used as a vehicle for this kind of scheme is a problem a single arrest doesn't resolve. Valve pulled PirateFi only after it had already drawn thousands of players, and last month separate researchers flagged malware embedded in Steam Workshop wallpapers targeting the same crypto-holding audience. The detection systems, to put it plainly, have room to improve.