Former Microsoft Employee Steals $10 Million In Xbox Gift Cards In Exchange For Bitcoins

A new revelation shows how Microsoft became the victim of a digital robbery committed by a former employee. This employee went on to steal millions of dollars in the form of gift cards that could be redeemed for things on the Microsoft Store.

Volodymyr Kvashuk, a former Microsoft software engineer hired in 2016, was testing the company's e-commerce infrastructure, Bloomberg reported. Kvashuk's responsibilities included making purchases with false accounts to see if the company's online payment system had any flaws or glitches.

During his time at Microsoft, Kvashuk uncovered a bug that created a redeemable 25-digit code every time he faked a Microsoft gift card transaction. Kvashuk was able to generate an infinite number of codes that he could use on Microsoft's digital shop to buy various digital things, such as games available on the Xbox store, thanks to this bug.

Kvashuk failed to inform his manager or any of his higher-ups at Microsoft about the bug. Hence, he chose to use it to sell newly produced codes to a third-party website at a discounted rate, saving up to 55 percent. In addition, he did it using test email accounts affiliated with his colleagues.

Kvashuk moved to bitcoin marketplaces like Paxful to sell the codes, according to PCGamer. He'd sell the Xbox gift cards in bulk at a discount there, then resell them to people looking for codes.

The employee began with a small amount of $10 Xbox gift cards. He subsequently progressed to larger numbers such as $100 while completing his shifts, enlisting the assistance of a few coworkers. He employed various user profiles to hide his footprints. He diverted his internet traffic through offshore servers in Japan and Russia. To further obfuscate the trail, he used money laundering websites like ChipMixer.

He would also use a "bitcoin mixing service" while moving the money he earned into his bank account to hide the source of the payment. Kvashuk deposited $2.8 million in bitcoin into his bank and investment accounts in less than seven months. He also claimed that the bitcoin he received was a gift from a relative on fraudulent tax filings.

Microsoft eventually discovered what Kvashuk was up to, and he was sacked in June 2018. Kvashuk was convicted of 18 federal offenses in February 2020, facing deportation to Ukraine, must pay $8.3 million in damages, and is currently in jail with a release date of March 2027.