A Florida-based student has been arrested by the FBI after allegedly stealing over $220,000 in cryptocurrency by means of malware-packed free games on Steam.

The games in question include PirateFi, Dashverse, Lampy, Lunara, and BlockBlasters, all of which have now been removed from Steam. You might remember BlockBlasters from last September’s story about streamer RastalandTV, who realised he had lost $32,000 while playing the game to raise funds for his own cancer treatment. According to the FBI, the malware distributor and his collaborators had been marketing the games on Discord, LinkedIn, and Telegram. Over the past two years, they’ve apparently managed to infect around 8000 PCs.

As documented in a criminal complaint shared by TechCrunch and Techspot, the feds arrested one Zyaire Dontaevious Zamarion Wilkins on Tuesday 14th July, after announcing an investigation of Steam malware hacks this March.

According to the docs, the FBI tracked down Wilkins after interviewing an unnamed participant in the malware scheme. They then identified a crypto account containing stolen funds, which had been used to buy Uber gift cards. After subpoenaing Uber, the spooks then linked the cards to an account that has allegedly made deliveries to Wilkins, whose online handles include “Sibel.eth”. Then they got a search warrant for Wilkins’ residence, confiscating his laptop, phone, and logins for digital wallets.

There’s been no comment as of writing from Wilkins himself, or any lawyers representing him.

I’m morbidly interested in what it takes to develop a game for the purposes of malware infection that is just plausible and substantial enough to seem legit, without costing too much to make. Be careful what you download, especially if it’s being bandied around for freezies.