The practice of purchasing online video game currency through third-party retailers is largely accepted, with a large number of websites dedicated specifically to this currency trade.

However, criminals have taken advantage of this thriving currency exchange to steal in-game currency and sell it for real money.

The ability to exchange video game currency for real-world money allows cybercriminals to regularly make money by stealing player accounts and information.

An in-depth Trend Micro report outlines the basic process followed by cybercriminals who make money using the virtual currency market:

Theft

The first step taken by cybercriminals is the acquisition of virtual currency from other player accounts.

The most common practices used to steal virtual currency from other players include hacking account credentials, phishing, and social engineering.

Once these criminals have access to another player’s account, they simply transfer that player’s currency to their own account.

Advertising

This is where the large number of virtual currency trading sites come in.

These users take their stolen currency and advertise across various platforms including dedicated sites, social media, and the deep web.

Most of these advertisements and websites are easily located without the need to venture into the Deep Web.

Selling

The cybercriminals can then easily sell their ill-gotten gains to various buyers, using a secure and accepted online transaction service.

Safe and legitimate transactions are ensured by using escrow services and trusted gold-selling websites.

Laundering

Now the cybercriminal has an amount of real money in their possession, and must process it in order to remove traces of past transactions.

This is easily done by converting the money to cryptocurrency, which makes it very difficult to trace previous transactions.

Some criminals choose to use money-cleaning services in addition to cryptocurrency conversion.

Usage

Now that the money has been cleaned, it can be withdrawn at leisure and used to fund future attacks on players and services.

Advanced hacking tools and DDoS attacks can be used to compromise account security and result in the entire cycle starting again.

Now read: The strangest lawsuits in gaming