The Cybercriminal Roots of Selling Online Gaming Currency

View: The Cybercriminal Roots of Selling Online Gaming Currency

Buying online game currency from third parties may sound relatively harmless—after all, it’s not illegal, the practice only involves virtual money used in an online game, and when all is said and done, it's hard to imagine it having any impact on the real world outside the game. Unfortunately,  we found that the trade of online game currency could lead to serious real-world implications. Not only did we discover that cybercriminals are actually profiting off this legally-gray practice, but also using it as a way to launder their stolen money and fund further cybercrime efforts.

First, the cybercriminals acquire the game currency, usually by exploiting bugs and loopholes in the game or by stealing it from player accounts. Then, after advertising the sale of stolen currency through websites and social media (and then the selling itself), the payments are converted into cryptocurrency to make it untraceable. This laundered currency can therefore be used in multiple ways, from buying even more online game currency to sell, to cash out for real-world expenses, or funding cybercriminal operations.

Many of these new online game currency websites are offering an experience similar to popular online shopping sites. Their proliferation and continued operation indicates that it is a very lucrative and sustainable revenue stream, which should be a concern because the revenue earned may indeed be going towards lining cybercriminals’ pockets to fund malicious attacks. 

The impact of this cybercriminal activity goes beyond the gaming industry. Apart from negatively impacting the affected games’ economies, enterprises in other industries also get affected as they are the ones victimized by attacks funded by online gaming currency sales.  

Online gamers should realize the real-world consequences of what they do, and consider that their decision to take shortcuts through obstacles (as opposed to working through them legitimately) may have a bigger impact. Cybercriminals will always continue to seek new revenue streams—legal and illegal—and turning a blind eye towards them in exchange for short-lived benefits could hurt us all in the long run, not just in-game but in real life.

Enterprises also must recognize this new revenue stream and take it as a sign that more attacks from malicious actors are inevitable, especially those fueled by this kind of service. Companies that are also involved with the games abused in such a manner should also move to address these websites and contribute to the effort of taking them down, or if not, simply to monitor them further for cybercriminal activity. Pushing local authorities to try and pass legislation to outlaw such practices can also help as well.

Read more in the research paper “The Cybercriminal Roots of Selling Online Gaming Currency.”