A Microsoft engineer taking advantage of an oversight in Microsoft accounts stole $10 million by selling Xbox Gift Cards for Bitcoin over a span of two years, Bloomberg reported. Volodymyr Kvashuk was sentenced to 9 years in prison and will be charged restitution of $8.3 million.
Volodymyr Kvashuk joined the company in 2017 as a Microsoft engineer to simulate purchases on its store. After entering, he realized that there are certain failings pertaining to the company’s accounts that test purchases. However, a simulated account works in a manner that it cannot send you substantial goods even if you try to purchase any item labeled, for instance, a gamepad. However, the gift card came with a string of 25-digit code. The digits, known as a 5×5 code, were no different from the numbers and letters etched onto the gift cards. The cards themselves are worthless, but each 5×5 code corresponds to a dollar amount. In this way, gift cards can be thought of as a sort of digital currency.
Normally an employee would have told his superiors and get the issue solved, but Kvashuk did quite the opposite. He had control over Microsoft’s account, so he took full advantage of the unlimited free codes which were at his disposal 24/7.
Initially, Kvashuk used to spawn himself with $5 or $10 codes now and then, but he had a better opportunity at stealing, so he decided to exploit his power to another level. He used mock profiles associated with his colleagues to hide his tracks, automating the process with a tailored software “created for one purpose, and one purpose only: to automate embezzlement and allow fraud and theft on a massive scale.” as prosecutors later described.
Once Kvashuk gets these codes, he would go to crypto marketplaces like Paxful to find potential buyers. Then, he’d sell them in large quantities at a relative discount which buyers would later sell to people who wanted to utilize the codes. In addition, money laundering sites like ChipMixer would let him hide his track records, making stealing a lot easier for him.
According to Bloomberg, Kavshuk’s salary was average, and he wasn’t making the kind of money that lets you spend extravagantly. So he couldn’t think of spending on a seaplane, a yacht, or to own sumptuous houses in California, Mercer Island, and all such luxurious paces.
But it had to end sometime. Microsoft noticed the scam after they spotted a sharp spike in their gift card transactions. The company took immediate action towards Kvashuk, and a federal agent in July 2017 raided his house.