19-Year-Old Nabbed in Ukraine for Hijacking 610,000 Roblox Accounts

A 19-year-old in Ukraine allegedly hijacked over 610,000 Roblox accounts in an effort to resell them for a fortune.

The suspect and two friends, ages 21 and 22, stole the Roblox accounts and listed them on a Russian web domain, where they sold them in exchange for cryptocurrency, according to Ukrainian law enforcement. The Office of the Prosecutor General published blurred photos that appear to show the suspects being arrested and their computers and residences being searched.

Investigators say malware was used to help the hackers hijack the accounts. The National Police of Ukraine says the trio used social engineering techniques and programming skills to infect victim computers with a “stealer program.”

The malicious program was disguised as software that promised bonuses or easier gameplay. But in reality, info-stealing malware can steal both passwords and authentication cookies to access online accounts. The Office of the Prosecutor General specifically flagged the cookie theft as the hijack vector.

“They primarily searched for profiles with accumulated virtual money or rare gaming items,” the office added. The scheme appears to have been extremely effective, stealing the login credentials for 610,000 accounts between October and January.

“According to preliminary information, the profit from the sale of accounts during the entire period of the group's activities could reach nearly 10 million UAH (US$228,050),” the prosecutor’s office added.

Investigators also seized US$35,000 during the suspects' arrest. They now face up to 15 years in prison.

Roblox didn’t immediately respond to a request for . The gaming platform currently has 151 million daily active users.