A 15-page federal prison grievance particulars how investigators mixed a Bitcoin path with Google cookies, telephone information, and greater than 500 Uber Eats deliveries to establish Zyaire Dontaevious Zamarion Wilkins because the alleged financier and marketer of a Steam malware marketing campaign. A later search uncovered a Monero seed phrase tied to roughly $382,000 in cumulative transaction exercise.
Federal brokers arrested Wilkins, 21, in Florida on July 14. The grievance, entered the next day, prices him with one rely of conspiracy to acquire data by laptop for personal monetary acquire.
The allegations concern the identical eight-game marketing campaign CryptoSlate reported on July 19. The FBI and the grievance allege that the marketing campaign contaminated roughly 8,000 units, accessed about 80 cryptocurrency wallets and stole not less than $220,000.
The grievance additionally lays out how investigators related marketing campaign funding to Wilkins and what they discovered after acquiring a residential search warrant.
Messages describe Wilkins’ alleged financing position
Prosecutors allege that one other participant created the developer accounts and launched the video games, whereas Wilkins equipped funding and helped market them.
The video games have been promoted by Discord, Telegram, X and LinkedIn, whereas bots allegedly recognized individuals with massive crypto holdings for focused messages.
Messages cited within the grievance embody discussions about spending $10,000 on a remote-access trojan, embedding malware in video games and persuading extra individuals to obtain them.
Topic #1 allegedly informed investigators that Wilkins supplied launch and advertising and marketing funds in change for a share of stolen cryptocurrency and entry to victims’ personal data.
Bitcoin funds opened a wider identification path
Investigators discovered the Bitcoin deal with in messages seized from an unnamed alleged co-conspirator recognized as “Topic #1,” based on the grievance.
Wilkins allegedly equipped the deal with to obtain funding for a cryptocurrency-draining marketing campaign, and investigators verified that the deal with obtained an roughly $10,000 fee on the day it was equipped.
The grievance says investigators subsequently recognized funds from the identical deal with to Bitrefill, which permits clients to buy reward playing cards and different digital merchandise with cryptocurrency.
Bitrefill information related the funds to at least one account that had bought greater than 150 reward playing cards, together with Uber Eats playing cards. The account was registered utilizing an electronic mail deal with that investigators then examined by information obtained from Google.
Google information allegedly linked that deal with by browser cookies to different accounts. One appeared to make use of Wilkins’ initials and was related to a College of West Florida pupil, whereas one other listed a telephone quantity as its restoration quantity.
Investigators additionally linked that quantity to an electronic mail deal with containing Wilkins’ identify, a Snapchat account that beforehand displayed his identify, and a T-Cellular account registered at an deal with related along with his household.
Greater than 500 meals orders narrowed the path to a few addresses
Uber recognized one account related to the Uber Eats reward playing cards, based on the grievance. That account was registered with the identical telephone quantity discovered within the different information.
Additional Uber information confirmed that the account positioned greater than 500 food-delivery orders between March 2024 and Might 2026, spending over $9,000. Each order went to one in every of three places: two addresses related to the College of West Florida and Wilkins’ North Lauderdale deal with.
The timing additionally adopted an alleged sample. Deliveries to the college addresses largely occurred whereas lessons have been in session, whereas orders exterior these intervals went to Wilkins’ household deal with. The grievance says roughly 15 deliveries went to the North Lauderdale deal with between Might 6 and Might 17, 2026.
The Uber information shaped one a part of a wider identification chain that included Bitrefill account knowledge, Google cookies, electronic mail addresses, telephone information, Snapchat knowledge, and mobile-location data.
The grievance doesn’t set up that each fee or meals order concerned stolen funds.
Search uncovered a Monero seed phrase tied to $382,000 in exercise
FBI brokers searched Wilkins’ North Lauderdale residence on July 8 and seized laptops, telephones, different digital units, and three cryptocurrency pockets seed phrases, based on the grievance.
One seed phrase was related to a Monero pockets containing eight addresses. Investigators stated the pockets’s transaction historical past confirmed that Wilkins had despatched or obtained roughly 1,233 XMR, valued at roughly $382,000.
The $382,000 determine displays cumulative transaction exercise described within the grievance. It’s separate from the alleged victim-loss estimate of not less than $220,000, and the submitting doesn’t characterize all 1,233 XMR as stolen funds or as Wilkins’ pockets steadiness.
The grievance’s identification narrative depends on the Bitcoin deal with and information from Bitrefill, Google, Uber, Snap, T-Cellular, and different suppliers. Investigators obtained the Monero proof after executing the residential search warrant, utilizing a seized seed phrase relatively than tracing Wilkins by Monero’s public transaction historical past.
Wilkins is presumed harmless except confirmed responsible. TechCrunch reported that his legal professional didn’t reply to a request for remark. Native 10 reported that Valve had not responded to its questions concerning the case and Steam’s safety measures by publication.
