It seems harmless: you download another indie game, launch it, play for a few hours… And later discover that your crypto wallet is empty.

According to the FBI, this is exactly the scheme used by a 21-year-old hacker who was recently arrested in the United States.

Over two years, he managed to:

• infect around 8,000 computers;
• gain access to approximately 80 cryptocurrency wallets;
• steal at least $220,000 worth of crypto.

And the most ironic part – he was not caught because of blockchain analytics.

How he was identified

After stealing funds, the attacker decided to cash out part of the cryptocurrency by purchasing Uber Eats gift cards.

The FBI sent an official request to the delivery service, obtained the address where food orders were regularly delivered, and soon the young hacker received a very different kind of “delivery”.

Instead of a courier with a burger, federal agents arrived at his door with a search warrant.

Sometimes even the most sophisticated cybercrimes end because of something as ordinary as pizza or a burger.

How the scheme worked

The most alarming part of this story is that the malware was not distributed through suspicious websites or pirate torrents.

It reached users through Steam.

The hacker published games that looked completely normal:

• they installed without errors;
• they launched successfully;
• users could actually play them;
• nothing seemed suspicious.

However, alongside the game, a hidden drainer was installed on the computer – malware designed to search for and steal cryptocurrency.

What is a drainer?

A drainer is a type of malware whose main purpose is to find everything related to cryptocurrency.

Such programs can:

• search for Seed Phrases;
• copy private keys;
• read browser data;
• detect installed crypto wallets;
• extract saved passwords;
• intercept clipboard content;
• take screenshots;
• monitor keyboard input;
• gain remote access to the system.

If users store wallet information on their computer without additional protection, the consequences can be devastating.

Why did Steam allow these games?

Many people assume that publishing a game on Steam means it has been fully inspected.

In reality, that is not exactly how it works.

Steam does perform moderation, but it mainly focuses on functionality, platform rules, and obvious violations.

Valve does not conduct a complete source-code audit of every game. With tens of thousands of projects published on Steam every year, this would be practically impossible.

Therefore, malicious code can theoretically enter the platform, especially if it is well hidden and does not immediately reveal itself.

Why crypto holders are especially vulnerable

Modern crypto wallets often interact with browsers.

A computer may contain:

• MetaMask, Rabby, Phantom, and other wallet extensions;
• configuration files;
• authentication tokens;
• saved passwords;
• clipboard history.

These become primary targets for attackers.

It is especially dangerous to store:

• Seed Phrases in text files;
• private keys on the desktop;
• passwords in notes;
• unencrypted wallet backups.

Does Steam run with administrator privileges?

This is a common misconception.

The Steam client does not always run as administrator. In normal mode, it operates with the same permissions as the Windows user.

However, any installed game has access to the files and data available to your user account.

If you manually run a game as administrator or approve privilege escalation through UAC, its capabilities increase significantly.

That is why launching unknown projects always carries some level of risk.

How to protect your crypto

If you hold digital assets, follow these basic rules:

• never store your Seed Phrase on your computer;
• use hardware wallets for large amounts;
• avoid installing unknown games from unknown developers without checking reviews;
• verify publishers and developer history;
• do not disable antivirus protection to launch a game;
• keep your operating system updated;
• store major holdings in cold wallets;
• use a separate profile or computer for cryptocurrency activities.

Final takeaway

This story once again proves that the biggest threat to crypto holders is not a blockchain hack – it is malware infecting their own devices.

Bitcoin, Ethereum, and other networks may be secured by strong cryptography, but if an attacker gains access to your device and steals your private keys or Seed Phrase, no technology can recover your funds.

Today, cybersecurity hygiene is just as important a part of investing as choosing promising assets. Sometimes a single accidentally installed game can be far more dangerous than any market volatility.