Ukraine Arrests Three Suspects Accused of Stealing and Selling 610,000 Roblox Accounts

Ukrainian authorities have arrested three suspects accused of running a large Roblox account theft scheme that targeted more than 610,000 user profiles. Prosecutors say the group made nearly 10 million Ukrainian hryvnias, or about $225,000, by selling stolen account access.

The arrests took place in the Lviv region after law enforcement carried out 10 searches connected to the suspects. Police seized cash, phones, computers, laptops, tablets, storage drives, bank cards, and written notes during the operation.

The case highlights the real-world value of gaming accounts. Roblox profiles can hold Robux, limited items, premium access, creator assets, and years of progress, which makes them attractive to cybercriminals and resale markets.

How the Roblox account theft scheme worked

According to prosecutors, a 19-year-old resident of Drohobych organized the scheme with two associates aged 21 and 22. The group allegedly targeted Roblox accounts from October 2025 to January 2026.

The suspects used stolen login data and malicious software disguised as game-related tools. Some reports also say the group used stolen session cookies, which can allow attackers to access an account without needing the password again.

Once they gained access, the suspects sorted accounts by value. They looked for accounts with rare digital items, virtual currency, and other assets that could make them easier to resell.

At a glance

Detail	Information
Platform targeted	Roblox
Accounts involved	More than 610,000 accounts checked or accessed
Estimated profit	Nearly 10 million UAH, around $225,000
Suspects	Three people aged 19, 21, and 22
Location	Lviv region, Ukraine
Main method	Stolen credentials, malicious tools, and session data abuse
Possible sentence	Up to 15 years in prison

High-value accounts were separated for resale

Investigators found 357 files containing high-value accounts. These profiles were selected because they contained valuable in-game resources, rare items, or other assets that could attract buyers.

The suspects allegedly sold the account data through Russian online resources and closed communities. Payments were made to cryptocurrency wallets, which helped the group move money outside normal payment systems.

Authorities say the total profit from the scheme could reach nearly 10 million UAH. The investigation remains open as police look for more victims and possible accomplices.

Why Roblox accounts are worth stealing

Roblox is not only a gaming platform. Users can create games, build assets, sell virtual items, buy premium content, and manage Robux balances.

For younger users, a stolen account can mean the loss of years of progress and digital items. For creators, it can also mean lost access to projects, earnings, audiences, and business opportunities.

This is why attackers often target Roblox users with fake game boosters, cheats, browser extensions, and “free Robux” tools. These files commonly hide malware or trick users into giving away account access.

Charges and penalties

The suspects face charges related to theft and unauthorized interference with information systems. Ukrainian authorities said the case falls under Article 185 and Article 361 of the country’s criminal code.

If convicted, the suspects could face up to 15 years in prison. Law enforcement also continues to examine seized devices and storage media as part of the wider investigation.

The case shows how gaming-related cybercrime can quickly become a serious financial crime. Stolen accounts can feed resale markets, fraud, money laundering, and further scams against players.

What Roblox users should do now

• Change your Roblox password if you downloaded any unofficial game tools, cheats, or browser extensions.
• Turn on two-step verification in Roblox account settings.
• Use a unique password that you do not use on any other website.
• Remove unknown browser extensions and run a full malware scan.
• Log out of all other sessions from Roblox security settings.
• Check your email and phone number to make sure attackers did not change recovery details.
• Contact Roblox Support quickly if you lost access to your account.

Parents should check children’s accounts too

Many Roblox users are children, so parents should help review account security. A child may not realize that a fake “enhancer” tool or free item offer can steal login data.

Parents should check whether the account has a verified email address, two-step verification, and no suspicious linked devices. They should also remind children that Roblox staff will not ask for passwords, cookies, 2SV codes, or backup codes.

The safest rule is simple. Do not download unofficial Roblox tools, do not buy accounts from third-party sellers, and do not enter login details anywhere except the official Roblox website or app.

FAQ