FBI complaint links Steam malware case to Bitcoin and Monero

Crypto users often focus on wallet security, but this case shows how spending trails around crypto can expose suspects even when privacy coins appear later in the story. A US federal complaint says investigators tied a Steam malware campaign to 21-year-old Zyaire Dontaevious Zamarion Wilkins by combining Bitcoin payments with records from Bitrefill, Google, Uber, Snap, T-Mobile, and mobile location data.

Prosecutors say the campaign used eight Steam games to infect about 8,000 devices, access around 80 crypto wallets, and steal at least $220,000. The complaint alleges Wilkins financed and helped market the operation, while another participant handled the developer accounts and game launches. Messages cited by investigators describe funding for malware, embedding it in games, and targeting people believed to hold large crypto balances.

The identity trail started with a Bitcoin address that allegedly received about $10,000 the same day it was shared for the campaign. Investigators say that address later funded Bitrefill purchases, including more than 150 gift cards. Uber records then showed over 500 Uber Eats orders worth more than $9,000 sent to three addresses linked to Wilkins.

After a July 8 search, agents say they found three wallet seed phrases. One was for a Monero wallet tied to about 1,233 XMR in cumulative transaction activity, roughly $382,000. The filing does not say all of that activity was stolen funds or the wallet balance.