Security1 publisher2 min readPublished
Software priced 610,000 stolen Roblox accounts by what was inside them
Prosecutors in Ukraine's Lviv region say three men spent about a year harvesting Roblox session cookies and running them through software that valued each account before sale. They put the potential take at $480,000.
The Watch · Security desk
What happened
- Prosecutors in Ukraine's western Lviv region said Tuesday that three men will stand trial over the theft of access to more than 610,000 Roblox accounts, which were sold to buyers in Russia.
- The credentials at the center of the case were session tokens, so from May 2025 until April 2026 the group opened live accounts without ever knowing a password.
- Police said in April that the accounts had been harvested with information-stealing malware disguised as software offering gaming advantages or free in-game bonuses.
- The alleged organizer is a 19-year-old from Drohobych who recruited two 22-year-old associates, and all three are now in custody.
- The counts include theft, money laundering, unauthorized interference with computer systems and illegal sale of restricted information, with a maximum of 12 years in prison.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- capability The valuation software is the part that scales. It turns a heap of stolen cookies into a priced catalogue without a person opening a single account, and it flags the few accounts worth manual attention.
- constraint Tokens carried the whole path, and the controls that fire at sign-in stayed out of it. Session lifetime and token reuse detection are what a defender has left to act on.
- cost The loss falls on individual players whose currency and rare items set the resale price, on a platform whose audience is children and teenagers.
- precedent Ukrainian prosecutors pulled the sales side into the same case as the intrusion, charging the associates who ran the website, the Telegram channels, the buyer contact and the payouts.
The pricing worked in two steps. Prosecutors said the group fed the stolen tokens into software that first checked whether each one was still valid [5]. When a token opened an account, the program assessed the contents, including virtual currency and rare in-game items [6]. Checking validity is the cheap operation, and the content assessment only ran on tokens that survived it [5][6]. The output was a two-tier catalogue: the most valuable accounts sold one at a time, the rest bundled and moved in bulk or at a discount [7].
Investigators put some sales at around 70 rubles, about 80 cents an account [8]. The prosecutors' figure of roughly $480,000 is what the sales could have generated, not what the group is known to have collected [9]. Divide it by the 610,000 accounts and it comes to about 79 cents each [1]. Against that estimate, investigators traced nearly $54,000 in cryptocurrency proceeds converted into Ukrainian currency and paid into the suspects' bank accounts [10], around 11 percent of the total [2].
The window prosecutors described runs from May 2025 until April 2026 [2], roughly twelve months, an average near 50,000 accounts a month [3]. Ukrainian police announced the case in April, saying then that they had identified the alleged organizer and were still establishing its full scale [18]. Roblox users buy virtual items with the platform's currency, and the platform is popular with children and teenagers [17].
The sorting logic carries to other targets. A collection of stolen session cookies only gets a price once something logs in and looks, and at 80 cents a unit nobody opens 610,000 accounts by hand. Automation set the bulk price and picked out the accounts worth individual handling [7]. Prosecutors described Roblox accounts advertised on Russian online platforms and paid for through cryptocurrency wallets [16]; they did not describe corporate or SaaS targets. Test the cookie, then price what it opens: those two steps work the same way whatever service issued the cookie.
What to watch
- Whether the Lviv indictment identifies the buyers in Russia or the platforms that hosted the sales.
- Whether Roblox says how many of the 610,000 sessions it invalidated, and when.
- The trial date, and whether the 12-year maximum survives any plea arrangement.