SlowMist Flags 'Cracked TradingView Premium' as Wallet-Data Malware
- Published
- Updated
SlowMist warned that a fake “cracked” TradingView Premium download circulating on X is being used to spread Windows malware. The security firm said the sample is built to collect wallet and account data, and one post promoting the lure reached more than 360,000 views.
Key claims & sources
What it means
TradingView is a widely used charting platform whose Premium tier normally requires a paid subscription, making 'cracked' versions an attractive lure for retail traders. Pirated-software scams have targeted finance and crypto users for years, often riding on Telegram or Discord promotion. SlowMist, the blockchain security firm behind this alert, says this particular campaign disguised as a TradingView crack has been running for roughly 18 months before drawing public warning.
Anyone who downloads the fake installer risks handing over private keys, browser-saved passwords and Telegram session data to attackers, not just losing access to a paid charting feature. Traders who sought a free workaround now face a stronger incentive to buy legitimate subscriptions, run antivirus scans, and move funds to hardware wallets rather than keep keys in browser extensions. The scammer behind the X account gains stolen credentials; careless downloaders lose wallet control.
Infostealers hidden in cracked software remain one of the simplest ways to compromise a crypto user, because the theft happens outside any blockchain protocol and no smart contract audit can catch it. Rotating command servers through Telegram and Steam shows attackers exploiting mainstream platforms as infrastructure, which complicates takedown efforts. The episode is a reminder that self-custody's security depends entirely on the device and habits of the person holding the keys.
SlowMist's alert carries no confirmed victim count or theft figures yet, so the real scale of this campaign is still unknown. Watch whether SlowMist or other researchers publish wallet-drain evidence tied to this sample, and whether the flagged X account or its command infrastructure gets suspended. A rise in reported losses would confirm active exploitation; silence would suggest the warning mainly served as preventive disclosure.
Market reaction i
The total crypto market fell 1.8% in the 4 hours after the first headline, after falling 0.3% in the 2 hours before.
48 prices, one every 30 minutes
Coverage timeline
Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.
Other recent incidents
| When | What happened | Figure |
|---|---|---|
| 1 days ago | Initia · Private key leak incident | $615k |
| 2 days ago | Swarm · Supply chain attack incident | no figure in dollars |
| 2 days ago | Ankr Bridge · Cross-Chain Message Spoofing incident | $304.5k |
| 3 days ago | ACryptoS · Missing Input Validation incident | $665.4k |
| 3 days ago | LNbits · Software vulnerability incident | $1.7k |
4296 incidents stored