A massive cybercrime case is coming to light in Ukraine, where authorities have arrested three young men for hacking and selling hundreds of thousands of accounts on the popular gaming platform Roblox. According to police, the case involves more than 610,000 compromised accounts, with the illegal financial gain estimated at around $225,000.
Extensive operations and seizures in Lviv
The arrests were made in the city of Lviv, following coordinated operation by authorities that included ten simultaneous searches in different locations. During the operations, approximately $35,000 in cash, 37 mobile phones, 11 desktop computers, seven laptops, five tablets and four USB drives were seized, indicating the scale and organized nature of the activity.
See also: Tri-Force Sentinel Operation: Authorities dismantle international fraud network
Although authorities initially did not name the target platform, the Attorney General's Office confirmed that it was Roblox, one of the largest online gaming platforms in the world.
How the cybercrime ring worked
The three arrested, aged 19, 21 and 22, are alleged to have organised a well-structured cyberattack network. The 19-year-old is said to be the main mastermind of the group, having recruited his two accomplices through gaming forums and online communities.
The attack method was based on the malware infostealer, which was presented as a tool to improve the gaming experience. Once installed on victims' devices, the software stole login and access credentials, giving the perpetrators full control over the accounts.
The value of Roblox accounts and the “gray market” of gaming
Roblox accounts are not just user registrations. In many cases, they come with high Robux balances , rare digital items, access to premium experiences, and years of in-game progress . This makes them particularly valuable on the secondary market.
See also: Taylor Swift deepfakes promote scams on TikTok
According to authorities, at least 357 of the 610,000 accounts compromised between October 2025 and January 2026 were classified as “high value,” indicating that the scheme did not operate randomly but selectively targeted more profitable accounts.
Distribution and sale through underground networks
The stolen accounts were sorted by value and then sold via a Russian website and closed online communities. The practice is a typical example of the so-called “gray market” economy in gaming, where digital assets change hands outside official channels.
The existence of such markets boosts the demand for cyberattacks, as compromised accounts are instantly converted into a marketable product.
Legal implications and ongoing investigation
The three defendants face serious charges under Articles 185 (theft) and 361 (unauthorized interference with computer systems) of Ukrainian law. If convicted, they could face prison sentences of up to 15 years.
Authorities are continuing their investigations to identify possible accomplices and additional victims, as it is estimated that the network may have had a greater reach than has already been revealed.
See also: LofyGang targets Minecraft players with LofyStealer
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Broader implications for security in the gaming ecosystem
The case highlights a growing trend in cybercrime: the targeting of gaming accounts as a financial asset. With millions of users and real value in digital items, platforms like Roblox have become an attractive target for organized groups.
Security experts point out that such attacks are mainly based on human weakness through phishing and malware. For this reason, using strong passwords, enabling multi-factor authentication , and avoiding installing unofficial tools are considered critical protection measures.
As the investigation continues, the case serves as a reminder that the digital gaming economy is not just entertainment, but also a field with real economic risks and serious cyber implications.
Source: www.bleepingcomputer.com
