A screenshot provided by Asil of his Yum! item being offered for sale. Image: Motherboard.
Roblox itself sells rare items known in the community as “limiteds,” which are available in a finite quantity. By playing certain Roblox games, players can also earn game specific rare items, such as “Ancient Weapons” from the Murder Mystery 2 game. Players can then trade limiteds with one another for other items or Robux, with Roblox displaying an item’s Recent Average Price (RAP) in Robux. Depending on how in demand or rare an item is, its value can fluctuate. Crucially, Roblox prohibits people from selling items directly for fiat currency.Below those Roblox-sanctioned systems sits an off-platform shadow economy of hackers and underground traders, some of whom steal and peddle items for cash and cryptocurrency in violation of Roblox’s terms of service and sometimes the law. This collection of websites, companies, and Discord servers includes online casinos where players can gamble items on a coin flip or on a game of rock, pepper, scissors, and digital marketplaces for selling the limiteds.Do you know anything else about Roblox beaming? Or Roblox marketplaces? Do you work at Roblox? We'd love to hear from you. Using a non-work phone or computer, you can contact Joseph Cox securely on Signal on +44 20 8133 5190, Wickr on josephcox, or email joseph.cox@vice.com.
A side by side comparison of a fake page on the left, and a real Roblox profile on the right. Image: Motherboard
Screenshots of a generator for fake PayPal payment confirmations. Image: Motherboard
Once a hacker has broken in and stolen the victim’s items by starting a trade with another account the hacker controls, they need somewhere to pawn the items. Some of the beamer Discord servers have channels for trading. But they can also turn to unauthorized third-party marketplaces that allow trades with real money and cryptocurrency, something that Roblox itself does not allow.“I go to servers with rich idiots then message every single one of them.”
Roblox for its part has seemingly taken action against the underground marketplaces. Adurite’s Discord server was recently removed. Place temporarily shut down after allegedly receiving a legal threat from the company. The owner of RBX.Flip, the gambling site, previously told RoZone that Roblox sent a legal demand to Amazon Web Services and their subsequent host, which both took the site down. RBX.Flip then moved to another “offshore” host “who doesn’t really care” about the DMCA copyright law, they said.Roblox does offer users the ability to “rollback” an item trade, which can be used if a hacker stole their items. But Roblox only offers one rollback per account, which isn’t helpful to people who had items stolen across multiple trades. Roblox told Motherboard that it has limitations on its restore policies to prevent abuse, but reviews inquiries on a case-by-case basis.A Roblox spokesperson told Motherboard in an emailed statement that it “aggressively deters moving activity off Roblox because we cannot control activity on other applications, which rarely have comparable safety policies, account restrictions, parental controls, and other protections.”“Users cannot exchange in-game virtual currency for real-world currency on Roblox outside of our developer exchange program and we specifically ban the use of third-party trading sites. We constantly monitor our platform to ensure that our users have a safe experience and will take appropriate action to address any issues that could have an impact on safety, and offer one-time recovery of any inventory lost,” the statement added. Roblox also said it offers users two-factor authentication, where players need to input an extra code from a smartphone app or their email to login in the hopes of keeping some hackers, and that if the company detects suspicious activity on a Roblox account, it prompts the user to change their password.“We’ve spent over a decade building a stringent safety and security system and policies that we are proud of and that we are continuously evolving as our community grows. The Roblox InfoSec team, in particular, actively mines various sources for threat intelligence, monitoring for malicious activity and taking appropriate action,” the spokesperson added.For Asil, the measures in place were not enough. At the time of writing, he is still locked out of his account, and hasn’t had his Roblox items returned. He’s lost motivation with Roblox in general, he said. “I lost so much,” he said.Subscribe to our cybersecurity podcast, CYBER. Subscribe to our new Twitch channel.“If it's a girl say ‘oh my god, your outfit is so pretty :D’ if it's a boy say ‘your avatar is sick’.”