Hackers arrested for hijacking and selling 610,000 Roblox accounts

Source: Bleeping Computer

The Ukrainian police have arrested three individuals who hacked more than 610,000 Roblox gaming accounts and sold them for a profit of $225,000. The arrests were made by the police in Lviv after conducting ten searches on targeted locations, seizing $35,000 in cash, 37 mobile phones, 11 desktop computers, seven laptops, five tablets, and four USB drives.

Arrests and Seizures

Although the police did not initially specify the game platform, the Prosecutor General’s Office confirmed that the victims were Roblox users. The three suspects, aged 19, 21, and 22, were detained in Lviv.

“Prosecutors of the Lviv region, together with the cyber police and the Security Service of Ukraine, have stopped the activities of a group that gained access to other people’s gaming accounts and used them as a source of income,” reads the press release from the Prosecutor General’s Office.

“This concerns profiles in Roblox, where users create games, communicate, and purchase virtual items with in-game currency. For many, such accounts hold not only gaming value but also financial value due to accumulated resources and purchased items.”

Image from the police operation
Source: gp.gov.ua

Details of the Hack

Roblox accounts are valuable beyond gameplay; they can be used in Roblox Studio to build assets and sell items for the in‑game currency Robux. Many accounts hold monetary value because they contain:

• High Robux balances
• Limited‑edition items that are no longer obtainable
• Years of in‑game progress, unlocks, and achievements
• Paid access to premium content

The authorities state that at least 357 of the 610,000 compromised accounts were high‑value (“elite”) accounts.

The 19‑year‑old suspect was identified as the leader of the group. He recruited the other two members on gaming forums and organized the hacking scheme, which involved:

1. Promoting info‑stealing malware disguised as a “game‑enhancer” tool.
2. Infecting victims’ devices and harvesting login credentials.
3. Categorizing stolen accounts by value, inventory rarity, and remaining Robux balances.
4. Selling the accounts via a Russian website and closed online communities.

Legal Consequences

The hackers were charged under Ukrainian criminal code articles:

• Article 185 – Theft
• Article 361 – Unauthorized interference with IT systems

Each faces up to 15 years of imprisonment.

Ongoing Investigation

Authorities continue to investigate to identify additional accomplices and victims of the hacking group.