{"id":10911,"date":"2026-07-19T13:43:28","date_gmt":"2026-07-19T13:43:28","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=10911"},"modified":"2026-07-19T13:43:28","modified_gmt":"2026-07-19T13:43:28","slug":"crypto-malware-in-8-steam-games-steals-tokens-after-leaving-trail-to-uber-eats-deliveries","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=10911","title":{"rendered":"Crypto malware in 8 Steam games steals tokens after leaving trail to Uber Eats deliveries"},"content":{"rendered":"

<\/p>\n

\n

The FBI is seeking potential victims who downloaded eight games named in its Steam malware investigation, a case that shows crypto custody can fail before a wallet ever opens.<\/p>\n

In a separate federal complaint reported by Local 10, agents allege an eight-game campaign infected about 8,000 devices, gained unauthorized access to roughly 80 crypto wallets, and stole at least $220,000.<\/p>\n

Local 10 reported that agents arrested 21-year-old Zyaire Dontaevious Zamarion Wilkins on July 14 and accused him of financing and procuring malware and helping market the infected games. The complaint describes the venue only as a \u201cpopular digital distribution software company.\u201d Wilkins is presumed innocent unless convicted.<\/p>\n

The FBI notice lists BlockBlasters, Chemia, Dashverse, DashFPS, Lampy, Lunara, PirateFi and Tokenova, and places the suspected Steam activity between May 2024 and January 2026. Local 10 reported that the complaint dates its broader alleged campaign through February 2026.<\/p>\n

\n
\"Top-ranked\"Top-ranked<\/div>\n
Related Reading<\/span><\/p>\n

Top-ranked Chrome \u2018wallet\u2019 sneakily steals crypto seedphrases<\/h3>\n

A top-ranked Chrome wallet quietly exfiltrated seed phrases using Sui micro-transactions\u2014and no one noticed until it was too late.<\/p>\n

Nov 23, 2025<\/span> \u00b7<\/span> Andjela Radmilac<\/span><\/p>\n<\/div><\/div>\n

\"An\"An
Cartoon showing an anthropomorphic Bitcoin detective watching a frightened hardware wallet get pulled toward a hooked Install button beside eight suspicious game tiles.<\/figcaption><\/figure>\n

Custody begins at software distribution<\/h2>\n

According to the complaint, the alleged group promoted the games on Discord, Telegram, X, and LinkedIn. Bots identified people with large crypto holdings and sent targeted messages encouraging them to download. Once installed, the malware allegedly captured private data and credentials; the group also discussed tricking victims into authorizing transactions that emptied wallets.<\/p>\n

One FBI-listed title shows how a trusted download could expose wallet data. A February 2025 cyber advisory said PirateFi was available on Steam from Feb. 6 to Feb. 12, 2025, and that it contained the Vidar infostealer, which could steal credentials, session cookies, and crypto wallet information.<\/p>\n

\n
\"CryptoBandits\"CryptoBandits<\/div>\n
Related Reading<\/span><\/p>\n

CryptoBandits malware lets criminals use your USB drive to access crypto wallets \u2013 Microsoft warns<\/h3>\n

Microsoft says the CryptoBandits malware uses USB shortcuts, clipboard monitoring, and Tor to target wallet workflows before funds move.<\/p>\n

Jun 22, 2026<\/span> \u00b7<\/span> Liam ‘Akiba’ Wright<\/span><\/p>\n<\/div><\/div>\n

The attack chain creates two control layers. Valve’s onboarding documentation says initial builds are checked for harmful behavior, but its review documentation says approved games can later be updated without another review. Those documents do not establish how the games in this case allegedly bypassed controls, but they show that scrutiny must cover both initial and updated builds.<\/p>\n

\n
\n
CryptoSlate Daily Brief<\/span><\/p>\n

Daily signals, zero noise.<\/h3>\n

Market-moving headlines and context delivered every morning in one tight read.<\/p>\n

5-minute digest<\/span> 100k+ readers<\/span><\/p>\n<\/div>\n

\n

Free. No spam. Unsubscribe any time.<\/p>\n

Whoops, looks like there was a problem. Please try again.<\/span><\/p>\n

You\u2019re subscribed. Welcome aboard.<\/span><\/p>\n<\/div>\n<\/div>\n<\/div>\n

For wallet users, an official marketplace cannot be the only trust boundary. Keeping wallet secrets and authenticated sessions away from gaming endpoints limits what an infostealer can reach, while deliberately reviewing transaction prompts addresses the separate risk of approving a malicious transfer. Neither control replaces marketplace screening.<\/p>\n

\"Infographic\"Infographic<\/p>\n

The alleged payment trail exposes the reverse side of the attack. Local 10 reported that investigators followed Bitcoin payments from a scheme-linked wallet to Bitrefill, an online service used to buy more than 150 digital gift cards, mostly for Uber Eats. A subpoena to Uber then allegedly connected those cards to an account with deliveries to addresses associated with Wilkins.<\/p>\n

\n
\"One\"One<\/div>\n
Related Reading<\/span><\/p>\n

One crypto wallet tied to a 20-year-old fraudster processed over $122M before Interpol closed in<\/h3>\n

The Thailand case shows how cross-chain token swaps can complicate tracing across services, assets and borders.<\/p>\n

Jul 12, 2026<\/span> \u00b7<\/span> Liam ‘Akiba’ Wright<\/span><\/p>\n<\/div><\/div>\n

Blockchain transparency did not prevent the thefts, but it allegedly preserved a traceable path until the funds touched an identity-linked service. Software distribution is therefore part of custody security before an incident; on-chain records and off-ramp data can become investigative evidence after one.<\/p>\n<\/div>\n

Community,Culture,Featured,Gaming,Hacks,Scams,Bitcoin,BTC,paymentsBitcoin,BTC,payments#Crypto #malware #Steam #games #steals #tokens #leaving #trail #Uber #Eats #deliveries1784468608<\/p>\n","protected":false},"excerpt":{"rendered":"

The FBI is seeking potential victims who downloaded eight games named in its Steam malware investigation, a case that shows crypto custody can fail before a wallet ever opens. In a separate federal complaint reported by Local 10, agents allege an eight-game campaign infected about 8,000 devices, gained unauthorized access to roughly 80 crypto wallets,<\/p>\n","protected":false},"author":1,"featured_media":10912,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[91,285,62,5582,5581,3334,531,3332,167,2122,3333,234,5291,5580],"class_list":["post-10911","post","type-post","status-publish","format-standard","has-post-thumbnail","category-ethereum","tag-bitcoin","tag-btc","tag-crypto","tag-deliveries","tag-eats","tag-games","tag-leaving","tag-malware","tag-payments","tag-steals","tag-steam","tag-tokens","tag-trail","tag-uber"],"yoast_head":"\nCrypto malware in 8 Steam games steals tokens after leaving trail to Uber Eats deliveries - Crypto News: Latest Cryptocurrency News and Analysis<\/title>\n<meta name=\"description\" content=\"Steam crypto malware allegedly stole $220K from crypto wallets, exposing a hidden attack before users even open them.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptonews.uk.com\/?p=10911\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Crypto malware in 8 Steam games steals tokens after leaving trail to Uber Eats deliveries\" \/>\n<meta property=\"og:description\" content=\"Steam crypto malware allegedly stole $220K from crypto wallets, exposing a hidden attack before users even open them.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptonews.uk.com\/?p=10911\" \/>\n<meta property=\"og:site_name\" content=\"Crypto News: Latest Cryptocurrency News and Analysis\" \/>\n<meta property=\"article:published_time\" content=\"2026-07-19T13:43:28+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/07\/infected-game-download-crypto-wallet-drain.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"\u884c\u653f\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u884c\u653f\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=10911\",\"url\":\"https:\/\/cryptonews.uk.com\/?p=10911\",\"name\":\"Crypto malware in 8 Steam games steals tokens after leaving trail to Uber Eats deliveries - Crypto News: Latest Cryptocurrency News and Analysis\",\"isPartOf\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=10911#primaryimage\"},\"image\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=10911#primaryimage\"},\"thumbnailUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/07\/infected-game-download-crypto-wallet-drain.jpg\",\"datePublished\":\"2026-07-19T13:43:28+00:00\",\"author\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\"},\"description\":\"Steam crypto malware allegedly stole $220K from crypto wallets, exposing a hidden attack before users even open them.\",\"breadcrumb\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=10911#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cryptonews.uk.com\/?p=10911\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=10911#primaryimage\",\"url\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/07\/infected-game-download-crypto-wallet-drain.jpg\",\"contentUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/07\/infected-game-download-crypto-wallet-drain.jpg\",\"width\":1280,\"height\":720},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=10911#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cryptonews.uk.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Crypto malware in 8 Steam games steals tokens after leaving trail to Uber Eats deliveries\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cryptonews.uk.com\/#website\",\"url\":\"https:\/\/cryptonews.uk.com\/\",\"name\":\"Crypto News: Latest Cryptocurrency News and Analysis\",\"description\":\"Latest Crypto & Bitcoin News\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/cryptonews.uk.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\",\"name\":\"\u884c\u653f\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"caption\":\"\u884c\u653f\"},\"sameAs\":[\"http:\/\/demo3.aiwalls.com\/coinbase\"],\"url\":\"https:\/\/cryptonews.uk.com\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Crypto malware in 8 Steam games steals tokens after leaving trail to Uber Eats deliveries - Crypto News: Latest Cryptocurrency News and Analysis","description":"Steam crypto malware allegedly stole $220K from crypto wallets, exposing a hidden attack before users even open them.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptonews.uk.com\/?p=10911","og_locale":"en_US","og_type":"article","og_title":"Crypto malware in 8 Steam games steals tokens after leaving trail to Uber Eats deliveries","og_description":"Steam crypto malware allegedly stole $220K from crypto wallets, exposing a hidden attack before users even open them.","og_url":"https:\/\/cryptonews.uk.com\/?p=10911","og_site_name":"Crypto News: Latest Cryptocurrency News and Analysis","article_published_time":"2026-07-19T13:43:28+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/07\/infected-game-download-crypto-wallet-drain.jpg","type":"image\/jpeg"}],"author":"\u884c\u653f","twitter_card":"summary_large_image","twitter_misc":{"Written by":"\u884c\u653f","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/cryptonews.uk.com\/?p=10911","url":"https:\/\/cryptonews.uk.com\/?p=10911","name":"Crypto malware in 8 Steam games steals tokens after leaving trail to Uber Eats deliveries - Crypto News: Latest Cryptocurrency News and Analysis","isPartOf":{"@id":"https:\/\/cryptonews.uk.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cryptonews.uk.com\/?p=10911#primaryimage"},"image":{"@id":"https:\/\/cryptonews.uk.com\/?p=10911#primaryimage"},"thumbnailUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/07\/infected-game-download-crypto-wallet-drain.jpg","datePublished":"2026-07-19T13:43:28+00:00","author":{"@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf"},"description":"Steam crypto malware allegedly stole $220K from crypto wallets, exposing a hidden attack before users even open them.","breadcrumb":{"@id":"https:\/\/cryptonews.uk.com\/?p=10911#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptonews.uk.com\/?p=10911"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/?p=10911#primaryimage","url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/07\/infected-game-download-crypto-wallet-drain.jpg","contentUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/07\/infected-game-download-crypto-wallet-drain.jpg","width":1280,"height":720},{"@type":"BreadcrumbList","@id":"https:\/\/cryptonews.uk.com\/?p=10911#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptonews.uk.com\/"},{"@type":"ListItem","position":2,"name":"Crypto malware in 8 Steam games steals tokens after leaving trail to Uber Eats deliveries"}]},{"@type":"WebSite","@id":"https:\/\/cryptonews.uk.com\/#website","url":"https:\/\/cryptonews.uk.com\/","name":"Crypto News: Latest Cryptocurrency News and Analysis","description":"Latest Crypto & Bitcoin News","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cryptonews.uk.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf","name":"\u884c\u653f","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","caption":"\u884c\u653f"},"sameAs":["http:\/\/demo3.aiwalls.com\/coinbase"],"url":"https:\/\/cryptonews.uk.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/10911","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10911"}],"version-history":[{"count":0,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/10911\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/media\/10912"}],"wp:attachment":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10911"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10911"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10911"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}