Three Ukrainians Charged in Massive Roblox Account Theft Ring
Ukrainian authorities have announced charges against three individuals accused of compromising over 610,000 Roblox accounts and selling the stolen credentials.
Ukrainian law enforcement has revealed that three Ukrainian nationals will face charges for their alleged involvement in a sophisticated operation that compromised more than 610,000 Roblox accounts. The group is accused of stealing digital credentials and subsequently selling them to buyers in Russia, highlighting a significant breach of user accounts on the popular gaming platform.
Prosecutors in Ukraine’s western Lviv region stated that from May 2025 to April 2026, the suspects allegedly used malware to steal session tokens, also known as cookies. These tokens allow attackers to hijack active accounts without needing the user's password. The attackers then employed software to identify accounts containing valuable virtual currency, rare in-game items, or other digital assets that could be resold for a profit.
Roblox, a platform widely used by children and teenagers for playing games, creating avatars, and purchasing virtual items, became the target of this extensive credential theft. The alleged organizer, a 19-year-old from Drohobych, is accused of recruiting two 22-year-old associates to carry out the operation. This case was initially announced by Ukrainian authorities in April, at which time they had identified the alleged organizer and were investigating the full scope of the scheme.
Authorities previously indicated that the attackers distributed information-stealing malware disguised as software offering gaming advantages or free in-game bonuses. The operation was reportedly divided among the members, with the organizer assigning tasks, managing server infrastructure, overseeing sales, and distributing profits. The associates allegedly managed the website and Telegram channels used to advertise the stolen accounts, communicated with buyers, and handled financial transactions.
The stolen session tokens were fed into custom software that verified their validity. Once a valid token was identified, the program assessed the contents of the associated Roblox account, prioritizing those with high-value virtual currency or rare items. The most lucrative accounts were sold individually, while less valuable ones were bundled and sold at a discount.
The group allegedly advertised the compromised accounts on Russian online platforms and accepted payments in cryptocurrency. Investigators estimate that the sale of these accounts could have generated approximately $480,000. Authorities have traced nearly $54,000 in cryptocurrency proceeds that were converted into Ukrainian currency and transferred to the suspects' bank accounts.
All three suspects are currently in custody and face serious charges, including theft, money laundering, unauthorized interference with computer systems, and the illegal sale of restricted information. If convicted, they could face a maximum sentence of 12 years in prison. This incident underscores the persistent threat of account takeovers and the illicit trade of stolen credentials in the online gaming ecosystem.