The Game They Never Owned

According to 404 Media, attackers have moved past the old grift of skimming in-game items and Robux. They're seizing entire games — hijacking the whole experience, redirecting the players, taking something a creator may have spent thousands of hours building, in a single move. Not a pickpocket working the marketplace. A landlord changing the locks.

The Roblox pitch has always been creator empowerment: build your own world, run your own economy, some teenager becomes a millionaire off an obby. And some did. The platform loves those stories — they're the recruitment poster. What the poster leaves off is the fine print under every platform economy: you build the value, they own the ground it stands on.

A Roblox "game" isn't software you own. It's a configuration of assets living inside Roblox's runtime, governed by Roblox's account system, monetized in Roblox's currency, discoverable only through Roblox's algorithm. The creator builds the intelligence. The platform owns the substrate. And when the substrate is compromised — a phished credential, a hijacked session, a stolen cookie — everything built on top of it transfers with the keys. You don't lose a feature. You lose the whole thing, because you never held the whole thing to begin with.

This is the part that should bother you more than the hacking. The hack is just the stress test. Account takeover is a solved-and-unsolvable problem — it's been the same playbook since the first MMO gold farmer: social engineering, credential stuffing, session theft. Roblox will tighten 2FA, post a help-center article, call it handled. The attackers will adapt. They always do.

But the vulnerability isn't really the login flow. Owners get phished too — stand up your own server, lose the password, and you can lose that just as fast. The difference was never whether you get hit. It's what happens next. On your own substrate, a breach is a bad week: you re-key, restore from backup, and the title to the thing is still yours. On Roblox, a breach can be permanent, because "security" means trusting a platform to protect an asset it can revoke, restrict, or lose on your behalf — with no obligation to give it back. Tenancy didn't open the door. It decided that once someone walked through, nobody was required to let you back in.

There's a version of this story where the lesson is "use a stronger password." That's the version Roblox would prefer. The real lesson is older and harder: if you don't own the layer, you don't own what you built on it. Sovereignty isn't a setting you toggle on. It's whether the substrate is yours.

And even "the runtime" undersells the cage. Say you rebuild every asset somewhere else, brick by brick — you still can't pack up the part that actually mattered. The players don't come with you. The discovery algorithm that put you in front of them, the social graph that made the game spread — those never belonged to you for a second. Asset hosting you could, in principle, escape. The audience is the lock you can't pick. Roblox doesn't just own the ground you built on; it owns the crowd you built for, and that's the cage with no door at all.

Most creators can't own that substrate — that's the whole bargain, and for plenty of people it's a fair one. Roblox carries the hard infrastructure and brings the crowd; you bring the fun. Fine. But walk in clear-eyed. You're not an owner. You're renting the layer and building the brain, and the day the layer gets compromised, the brain goes with it — with no one obligated to hand it back.

The hackers didn't steal these games. They revealed how little the creators ever owned. The deed was never in their name; the breach just made them read it.