Three Ukrainians to face charges for alleged hack of 610,000 Roblox accounts
Three Ukrainians are facing criminal charges for allegedly hacking over 610,000 Roblox accounts and selling the stolen access to buyers in Russia. The operation involved stealing session tokens, identifying valuable accounts containing virtual currency and rare items, and distributing the compromised accounts through Russian online platforms. Authorities estimate the operation generated approximately $480,000 in revenue.
Three Ukrainians are set to stand trial for allegedly hacking over 610,000 Roblox accounts and selling the stolen access to buyers in Russia. The operation, which ran from May 2025 until April 2026, involved stealing digital credentials – session tokens – that allowed access to accounts without needing users’ passwords. Prosecutors in Ukraine’s western Lviv region allege that a 19-year-old man from Drohobych organized the scheme and recruited two 22-year-old associates.
The group used software to determine which accounts contained valuable virtual currency, rare in-game items, and other digital assets that could fetch higher prices on the resale market. Roblox is an online gaming and social platform particularly popular with children and teenagers, where users can play games largely created by other players, build avatars and buy virtual items using the platform’s currency.
Authorities first announced the case in April, when police said they had identified the alleged organizer and were investigating the full scale of the operation. The group allegedly advertised the accounts through Russian online platforms and received payments through cryptocurrency wallets. Some accounts were sold for around 70 Russian rubles ($.80) each, while others were bundled and sold in bulk.
Investigators said they traced nearly $54,000 in cryptocurrency proceeds that had been converted into Ukrainian currency and transferred to the suspects’ bank accounts. The suspects are facing charges including theft, money laundering, unauthorized interference with computer systems, and the illegal sale of restricted information. The offenses carry a maximum sentence of 12 years in prison.
Daryna Antoniuk is a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for Forbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.