A former Microsoft engineer has been convicted for stealing roughly $10 million by exploiting test accounts to generate Xbox gift card codes that he sold for bitcoin. The Ukrainian national, Volodymyr Kvashuk, was sentenced to nine years in prison and ordered to repay $8.3 million.
How the scheme worked
Kvashuk, who began working at Microsoft in 2017, identified a flaw in accounts used internally to simulate purchases and test the company’s payment systems. Those test accounts are typically flagged to prevent the dispatch of physical goods, but the safeguards did not block issuance of digital items.
Using the vulnerability, he obtained valid 25-digit Xbox gift card codes. Instead of reporting the issue, Kvashuk initially redeemed a few low-value codes for personal use, then escalated the operation.
Automation and resale for cryptocurrency
To scale and conceal his activity, Kvashuk automated the process by using profiles of colleagues’ simulation accounts and developed custom software. Prosecutors described the tool as “created for one purpose, and one purpose only: to automate embezzlement and enable large-scale fraud and theft.”
He sold the gift codes in bulk at a discount on cryptocurrency marketplaces such as Paxful. To launder proceeds, Kvashuk used services including ChipMixer, and used the funds to finance a lifestyle beyond what his Microsoft salary would support, prosecutors said.
Detection and legal outcome
The scheme came to light after Microsoft noticed a sudden spike in gift card transactions. In court, Kvashuk claimed he was conducting an experiment to boost store spending, but that argument was rejected.
He was convicted, received a nine-year prison sentence and faces an order to return $8.3 million. Authorities also indicated he may be deported to Ukraine following his sentence.
Source and related media
The case was detailed in a report citing original coverage by PC Gamer. A related video is available on YouTube.
