The Ukrainian authorities recently busted a cybercrime group and arrested three suspects involved in hacking over 610,000 Roblox accounts and selling the accounts for cryptocurrency. The group operated for four months (October 2025 to January 2026), led by a male from Drohobych aged 19.
The group exploited highly sought-after profiles on Roblox with valuable, rare items located within the game and amassed large amounts of virtual currency. They scanned tens of thousands of accounts each week for the highest value accounts, hacked those accounts, and then sold them through Russian underground cybercrime forums. Authorities estimate that their operations generated approximately 10 million hryvnias – this amounts to about $226,000.
All three individuals, aged 19, 21, and 22, face charges of conspiracy to commit a crime and unauthorized access to computer systems, both of which are felony offenses that carry up to 15 years in prison upon conviction.
Hackers used cookie theft and malware to bypass passwords
The hackers got into the accounts of many people using stolen session cookies, which are little files that maintain a user’s logged-in status on their website without needing to provide credentials each time they go back.
Also, the attackers used malware to steal login details. They distributed the malware via fake game enhancement software, which promised people who play the games bonuses for their game play or easier gaming experiences. Once someone installed and ran the fake game enhancement software, it would retrieve their session cookie and send it to the hacker as a way for them to access that person’s account.
This highlights a critical safety concern for parents: children may unknowingly download malicious software, thinking it’s a legitimate game enhancement. Our guide on whether Roblox is safe for kids explains how to spot fake downloads and teach children safe online habits.
The hackers then used a special program to verify the accounts they had access to and identify what items had value and could be sold. They primarily focused on accounts of people who had either a significant amount of virtual currency (which is real money) or rare gaming collectibles; of the 610,000 scanned accounts, they compiled 357 files of the most valuable accounts.
Law enforcement officials indicated that many Roblox users spend significant amounts of money, in the form of real money, to buy in-game items, therefore making their accounts attractive targets to cybercriminals.
Police seized cash, electronics, and account files during raids
Ukrainian authorities executed ten search warrants at various properties linked to the suspects and seized computer devices, storage media, cell phones, credit cards, and handwritten notes. They seized approximately €2,500 and nearly $35,000 in cash.
The prosecutor’s office stated they have uncovered 357 files that contain the stolen login information to Roblox accounts, which the hackers had sold through various Russian resources, and the funds for these transactions came through cryptocurrency to provide anonymity.
The Lviv Regional Prosecutor’s Office and the Frankivsk District Prosecutor’s Office provided the procedural oversight on this case came from. Also, the Cyber Police and Security Service of Ukraine (SBU) personnel assisted with terminating the operation.
During one of the searches at the 44-year-old male’s house – an acquaintance of the suspect – officers discovered what they believed to be cannabis. Authorities detained that individual on suspicion of illegal drug possession with intent to sell.
Roblox’s young user base makes account security critical
Roblox is a digital gaming site where users can make games, connect with others, and use real-life dollars to buy virtual goods. This site receives more than 85 million users per day, and about 40% of those users are younger than 12 years old.
To many young users, their Roblox accounts may have a significant amount of real-world dollars tied to them through virtual currencies and goods that they purchased. The ability of users to trade virtual currency and items within Roblox allows criminals to target their accounts, creating a secondary market for stolen accounts.
According to the Attorney General’s Office, stealing account logins could cause financial harm to victims beyond just losing their player level. Once criminals steal a user’s account, they could drain all of the user’s virtual currency or sell their rare virtual goods for real dollars.
This incident demonstrates the increasing risk of Infostealer malware on gaming sites. Security experts also suggest users turn on two-factor authentication on their Roblox account and try to avoid downloading unverified software to enhance their game.
The stolen credentials from such operations often end up for sale on dark web forums like RaidForums, a platform recently seized by the DOJ, which served as a marketplace for cybercriminals to buy and sell millions of compromised accounts, from gaming logins to financial data.
Investigation remains active, and authorities are still reviewing the evidence to identify the entire scope of this operation.
