Roblox Robux Ransom: How Teen Hackers Built a Black Market Empire

Gamers can easily be considered among the groups of people most vulnerable to fraudulent attacks. Often, young players find ways to download entertainment cheaper or even for free.

The same applies to in-game collectible items - instead of purchasing from the official seller, gamers frequently turn to other users or questionable websites selling game items at much lower prices.

It is precisely the reluctance to pay for licensed software, game items, and inventory that can lead gamers into the hands of malicious actors, who are then capable of obtaining personal data in just a few steps. And if the victim is a child, no special tricks are needed beyond smooth talking.

In addition to saving money, the thrill of new skins, advantageous item trades, or obtaining limited-edition antiques can also push gamers towards careless (in terms of security) actions. In such cases, clicking a link or entering a login doesn't seem risky - who would want to deceive for just one in-game item? But there are those who do.

The journalists at the IGN portal conducted an investigation into fraud on the popular online gaming platform Roblox. Spoiler: the main hackers who breach accounts, steal personal data along with in-game items, and even "launder" money, are teenagers. We will share the key points from the article.

Roblox is a virtual gaming platform where users can create their own games, visit a variety of virtual worlds, interact with other users, and organize collaborative events. In other words, Roblox is a sandbox where users can become both game developers and guests in worlds created by other users.

The platform was released in 2006, and within 9 years it became available on all Xbox One consoles, iOS and Android devices. Currently, Roblox is one of the most popular metaverses for gamers - the Google Play Store reports over 500 million downloads of the app, says Android Police.

At the same time, the average age of the user base has also increased. While a year ago it was 12 years old, now, due to the growth in platform popularity and the addition of new content, the average user age is 13 years old. Nevertheless, the core audience of the platform remains Gen Z users aged 9 to 25 years old.

Not only creators, but also the players themselves can earn from the platform. Roblox has a virtual currency called Robux - users earn it by completing tasks, regularly launching the platform, and by purchasing it with real currency. Users can use these in-game "Robux" to acquire new skins, game inventory, and collectible items.

It is important to mention that the sandbox has a simple and, most importantly, free registration, a user-friendly interface, and reasonable system requirements. In other words, even elementary school students can easily access and use the platform. This is largely what attracts the teenagers who make up the majority of the platform's audience. However, scale, popularity, and accessibility do not always guarantee safety.

The black market of "cosmetics" and the development of child gambling on Robux

While the free entry and tools, as well as the lack of hosting fees for projects, benefit users, the platform itself does not earn a penny from this, and in fact, quite the opposite.

Roblox earns from the monetization of content, the possibilities of which in the service are, roughly speaking, no longer limited.

Luke Winkie in his material also mentions the investigations of Quentin Smith, dedicated to the lack of protection for teenagers who create games on the platform. The blogger describes in detail how the corporation turns a blind eye to moderation rules and neglects user safety in favor of its profits.

Smith emphasizes the in-game market for cosmetic items on the platform. On this shop, users can purchase clothing, skins, avatars, and character attributes for "Robux". The platform indeed offers a wide assortment of "cosmetics" to suit any taste. For example, the market often features collaborations of game items with the Vans brand or even avatars with popular celebrities.

And everything would be fine if the items for sale did not come in limited quantities or even sales periods. Users simply do not have time to buy them.

That is, after the end of the sales periods for the "cosmetics", users can obtain them either through exchanges with other players or by buying from them. And here, of course, users have the right to inflate the cost. According to the blogger, the price of cosmetics when purchased directly from users can be inflated by 50% or more.

Moreover, this is even profitable for the online platform itself, since the commission on any transactions is 30%. Roughly speaking, the more expensive users sell the "cosmetics", the more money the company will receive.

According to the blogger, the problem also lies in the existence of the virtual market itself, which operates similarly to the real one. Users can see the price change graphs for the "cosmetics" and, accordingly, their initial price.

There are a number of websites on the internet today where players can also exchange "robux" for dollars at a favorable rate. Among them are OPrewards.io, rbx.place, and rolimons.com. On these, savvy users sell in-game currency to make more money and buy more "cosmetics".

The formed black market entails a number of problems, including malware, hidden platform commissions, and of course the preconditions for the development of a gambling addiction in children through the resale of items.

But the most terrible problem is not only that teenagers have to spend a lot of real money. To own virtual assets, children sometimes resort to cyber fraud and hacking other users' accounts for their own enrichment. The company understands this perfectly well, but does nothing.

What is happening on Roblox now and how can some children steal thousands of dollars from other children?

Journalist Luke Winkie's investigation actually reveals common schemes of user deception, theft of funds, and personal information using phishing and social engineering. But what's really shocking is that the perpetrators are underage children themselves.

It turns out that players aged 12-13 have learned to ingratiate themselves with other young platform users and hack their accounts. Moreover, these young hackers are earning thousands of dollars from their fraudulent schemes.

The journalist penetrated the "criminal" side of Roblox and even managed to communicate with several teenage hackers through a special Discord service, where they discuss their "trophies" and share their experiences. One of the large-scale ones, according to the author of the material, is a forum called "Flex Your Beams", which is completely filled with screenshots of conversations with victims and even videos in which the hackers document their work and show its result: stolen "robux", card numbers, account passwords, expensive game inventory, and much more.

Screen recording documenting account hacks on Roblox / YouTube channel "Usernamee"

"I wrote a script called a pin-cracker. I run it and hack their pin codes."

One of the hackers that Luke was able to speak with, not only demonstrated the captured accounts and stolen funds, but also shared his personal hacking scheme.

The cyber-fraudster uses a self-written script to hack the pin codes of other players. He even showed the journalist a screenshot with the login and password of one of the victims. At that time, the hacked account's virtual wallet had 467,000 "robux", which is approximately $5,800.

Moreover, the 13-year-old fraudster does not consider his activity as professional work and does not treat the stolen funds as income. According to the hacker, fraud is just a hobby for him. However, it is worth noting that this hobby brings him about €2,000 per month.

"My parents don't know anything. When they ask where I get the money from, I just make excuses, but they believe me."

The fraudster also shared that he spends the proceeds on gifts for his friends and purchases of various things and gadgets for his room. For example, he told the journalist in a chat that one of his latest purchases at the time was a gaming computer worth €2,600.

But what surprised the journalist the most from the conversation was the hacker's age. According to Luke, he could not have thought that 13-year-old children are capable of using such professional schemes.

"We can convince them to do anything. For example, to click on a link and enter information. You just need to present it correctly and confidently."

Another fraudster that the journalist managed to contact hacks accounts through "basic" phishing schemes. The teenager is also only 13 years old, and the profit from cyber-theft, according to him, is already about €10,000 per week.

The gamer goes to the most popular games on the online platform and tracks down young users who have expensive collectible items. After that, he follows a well-developed scheme: he starts a conversation, convinces the user of the benefit they can get by clicking on his link, and accordingly, leaves a trap.

Of course, the gamer did not reveal the details. But it can be assumed that due to the phishing link, the victim leaves their login credentials.

The victims of underage fraudsters are other children

Luke Winke also contacted the other side of the conflict - the victim. Kristen Dagg shared how her daughter lost all the money she was given for her birthday.

11-year-old Alice purchased several screens on the Roblox market, but instead of the desired ones, she received several duplicates. So she decided to exchange them with one of the users. As a result, she became the victim of the same underage child, who, under the guise of exchanging "cosmetics", asked her to click on a phishing link.

So, the scammer ended up with Alice's account with all the inventory worth $300, and the girl was left with nothing. According to her mother, Alice's attitude towards the game has changed radically since then.

And that's not all - underage scammers have learned to "launder" money.

Scammers who break into other people's accounts and take the game inventory along with the game funds have a certain money laundering scheme.

For this, an online casino is used, where it is possible to place bets on virtual items. So, a journalist talked to a scammer who, together with his friend, plays "coin flip" on a similar site.

Both teenagers bet on someone else's "cosmetics" that they have taken from a hacked account. The items placed are temporarily transferred to the casino's bot account, so that after one of the players wins, the item can be transferred to them. But it is this intermediary in the form of an account bot that allows to hide any data about the previous movements of the inventory.

Thus, when the casino transfers the items back to one of the players, they become their property. In this way, the items are transformed from stolen to "clean", after which they can be freely traded and exchanged.

However, notes IGN, the developers of the sandbox are trying to strengthen protection and make the platform safe for the main audience - children. For example, in September 2022, they introduced a chat filter for people under 13 years old. However, it is still too early to say how effective this is and whether the company is taking any action to resolve criminal acts.