An oversight in Microsoft's accounts for testing its payment system allowed one engineer to cheat the company out of more than $10 million by selling Xbox gift cards in bitcoin over a two-year period, a new Bloomberg report revealed this week.

To make sure its payment system worked, Microsoft hired engineers to "simulate" purchases at its stores. However, shortly after joining the company in 2017, Volodymyr Kvashuk discovered that the accounts used to test purchases were flawed. Such accounts for simulations are usually flagged as such by the system, so that if you try to purchase a new gamepad from the company's site, for example, you will not receive the actual item. However, if you test the purchase of an Xbox gift card, you will receive a fully valid 25-digit code.

Kvaschuk could have easily reported this to his supervisor. However, having received an unlimited free code, he chose another option instead.

Initially, Kvaschuk created a handful of codes himself. However, he had the opportunity to make a life-changing fortune from this exploit. He began circulating mock profiles of his colleagues to cover his tracks, automating the process with custom-built software that prosecutors later described as "designed to automate embezzlement and enable large-scale fraud and theft."

After obtaining these codes, Kvaschuk heads to crypto marketplaces like Paxful to find sellers. He would sell the codes in bulk for relatively cheap, and the buyers would sell them to people who wanted to use them; money-laundering sites like ChipMixer covered his tracks, and the proceeds were used to promote an increasingly lavish lifestyle.

As Bloomberg points out, Kvaschuk's salary from Microsoft was not stingy. But it was not a sum that would allow him to plan for a seaplane, a yacht, and multiple luxury homes in places like Maui and Mercer Island, California.

Microsoft eventually discovered Kvaschuk's fraud after noticing a sharp increase in gift card transactions, and federal agents eventually raided his home in July 2019. In court, Kvaschuk attempted to argue that the mass theft was simply an experiment to increase the store's spending.

Obviously, that did not hold up. Kvashuk was sentenced to nine years in prison and will likely be deported back to his native Ukraine, where he will be charged with $8.3 million in damages. You won't find a gift card in the world that will cover that cost.