A mistake in Microsoft’s accounts allowed one engineer to swindle more than $10 million by selling Xbox Gift Cards for Bitcoin over the course of two years. This is according to a report from Bloomberg.
Microsoft has hired engineers to simulate purchases in its stores to ensure that its payment systems are working. Volodymyr Kvashuk, who joined the company in 2017, discovered a flaw with the accounts that were used to test purchases.
These simulated accounts are often flagged by the system as such and will not send you physical goods if, for example, you try to purchase a new Xbox gamepad from its website. However, if you tried to buy Xbox Gift Cards, the code would still be valid.
Kvashuk could have easily reported it to his bosses. He chose to use the unlimited number of codes he had at his disposal instead.
Kvashuk initially generated a few codes, earning him $5 to $10 each. This exploit offered the possibility to make huge, life-changing amounts of money.
To hide his tracks, he began to cycle through mock profiles of his colleagues, using a custom piece of software that was later described by prosecutors as “created for one purpose and one only: to automate embezzlement, allow fraud, and permit theft on a large scale.”
Kvashuk would then head to Paxful and other crypto markets to search for potential sellers after he had acquired these codes. Kvashuk would sell the codes in bulk at a discount to buyers who then sold them to people who were interested in using the codes.
Sites like ChipMixer that allow money laundering would enable him to hide his tracks, and the proceeds would go towards supporting a lavish lifestyle.
Bloomberg points out that Kvashuk’s Microsoft salary wasn’t cheap. It wasn’t enough to buy a seaplane or a yacht and many lavish homes in Maui, California, and Mercer Island.
Microsoft eventually became aware of Kvashuk’s antics when it noticed a sharp rise in gift card transactions. Federal agents raided his home in July 2019. Kvashuk argued that the mass theft was an experiment to increase store spending.
It didn’t work. Kvashuk was sentenced for 9 years, with the possibility of being deported to Ukraine. He will also be charged $8.3 million in restitution. Unfortunately, there is no gift card that will cover this expense.