Back
Federal complaint ties Steam malware suspect to Bitcoin trail and $382,000 Monero activity

Federal complaint ties Steam malware suspect to Bitcoin trail and $382,000 Monero activity

Prosecutors say Zyaire Dontaevious Zamarion Wilkins financed and marketed an eight-game campaign that allegedly infected about 8,000 devices and stole at least $220,000 from roughly 80 crypto wallets.

BTC
XMR

Fact Check
All key elements of the claim are corroborated by multiple independent sources. CryptoSlate, citing the federal criminal complaint, confirms Wilkins was tied to a Bitcoin trail and a Monero seed phrase associated with approximately $382,000 (1,233 XMR) in cumulative transaction activity, and that he allegedly provided funding and marketing for an eight-game campaign that infected roughly 8,000 devices and stole at least $220,000 from about 80 wallets. TechCrunch and Decrypt independently confirm the ~8,000 devices, ~80 wallets, and $220,000 figures and the conspiracy charge. A web search corroborated the $382,000 Monero figure. The claim's language ('prosecutors say,' 'allegedly') accurately reflects the presumption-of-innocence framing in the reporting.
Summary

Federal prosecutors have charged Zyaire Dontaevious Zamarion Wilkins, 21, with one count of conspiracy to obtain information by computer for private financial gain, alleging he financed and helped market a Steam malware campaign. Wilkins was arrested in Florida on July 14, and the criminal complaint was entered the following day. The filing ties him to an eight-game operation that the FBI says infected approximately 8,000 devices, accessed about 80 cryptocurrency wallets and stole at least $220,000. The identification chain described in the complaint combined on-chain Bitcoin tracing with consumer-platform records. Investigators said a Bitcoin address shared in messages with an alleged co-conspirator received an approximately $10,000 payment the day it was supplied, then made payments to Bitrefill, a service that sells gift cards for cryptocurrency. Records from Bitrefill, Google, Uber, Snap and T-Mobile, along with phone and location data, allegedly linked those transactions to Wilkins. Uber records showed more than 500 Uber Eats orders between March 2024 and May 2026, spending over $9,000 and going to two University of West Florida-linked addresses and Wilkins' North Lauderdale address. A July 8 search of Wilkins' North Lauderdale residence led agents to laptops, phones, other digital devices and three crypto wallet seed phrases (recovery words for a wallet). One was tied to a Monero wallet containing eight addresses with roughly 1,233 XMR in cumulative sent or received activity, valued at about $382,000. The complaint separates that cumulative Monero transaction total from the alleged victim losses and does not describe all of the XMR as stolen funds or as a wallet balance. Wilkins is presumed innocent unless proven guilty.

Terms & Concepts
  • Monero: Privacy-focused cryptocurrency that obscures transaction details.
  • seed phrases: Recovery words used to restore a crypto wallet.
  • XMR: The native token of the Monero network.