Three Ukrainian nationals are set to stand trial over an alleged cybercrime operation that compromised more than 610,000 Roblox accounts and sold access to buyers through Russian online platforms.
Prosecutors in Ukraine’s Lviv region say the operation was organized by a 19-year-old resident of Drohobych, who recruited two 22-year-old associates. The group allegedly operated from May 2025 until April 2026, turning stolen gaming accounts into a business based on the value of virtual currency and digital items stored inside them.
Investigators say the suspects obtained session tokens, also known as cookies, that allowed them to access Roblox profiles without knowing the owners’ passwords. Earlier findings from Ukrainian cyber police indicated that information-stealing malware was disguised as software promising gaming bonuses or advantages, tricking players into installing it on their devices.
After obtaining account access, the suspects allegedly used specialized software to determine whether stolen session tokens remained active and assess the contents of each profile. Accounts containing valuable virtual currency, rare equipment, or other desirable digital items were considered more profitable and were separated from less valuable profiles.
The most attractive accounts were allegedly sold individually, while lower-value profiles were bundled together and offered at discounted prices. Prosecutors say the group used a dedicated website and Telegram channels to advertise the stolen accounts on Russian online platforms, with customers paying in cryptocurrency.
Some accounts reportedly sold for around 70 Russian rubles each. Ukrainian prosecutors estimate that the database of compromised accounts had the potential to generate more than 20 million hryvnias, while investigators documented almost 2.4 million hryvnias in cryptocurrency proceeds that were converted into local currency and transferred to bank accounts.
Authorities say the alleged organizer managed much of the operation himself, including assigning tasks, paying for servers, supervising sales and distributing proceeds. His two associates are accused of helping operate the website and Telegram channels, communicating with customers and handling payments and withdrawals.
The case highlights how gaming accounts can have significant resale value even when attackers are not primarily interested in conventional financial information. Roblox profiles can contain purchased virtual currency, rare items, and other digital assets accumulated over years, making selected accounts attractive to underground buyers.
The three suspects were initially detained earlier in 2026 as Ukrainian authorities investigated the scale of the scheme. Searches connected to the investigation resulted in the seizure of computers, mobile phones, storage devices, bank cards, cash and other potential evidence.
Prosecutors have now filed an indictment against all three men. They face charges that include theft, unauthorized interference with computer systems, illegal sale of restricted access information and money laundering.