SlowMist Flags 'Cracked TradingView Premium' as Wallet-Data Malware

39Importance
no updates 6h+Status
4News media
Published
Updated

SlowMist warned that a fake “cracked” TradingView Premium download circulating on X is being used to spread Windows malware. The security firm said the sample is built to collect wallet and account data, and one post promoting the lure reached more than 360,000 views.

Key claims & sources

✓
SlowMist said the sample was also set up to steal private keys, browser logins, and messaging sessions.
✓
SlowMist described the Windows sample as an infostealer that can take browser credentials, crypto wallet data, and Telegram information.
✓
SlowMist said a Windows malware campaign was being promoted on X through a supposed cracked version of TradingView Premium.
✓
One post pushing the free download passed more than 360,000 views, according to SlowMist.

What it means

TradingView is a widely used charting platform whose Premium tier normally requires a paid subscription, making 'cracked' versions an attractive lure for retail traders. Pirated-software scams have targeted finance and crypto users for years, often riding on Telegram or Discord promotion. SlowMist, the blockchain security firm behind this alert, says this particular campaign disguised as a TradingView crack has been running for roughly 18 months before drawing public warning.

Anyone who downloads the fake installer risks handing over private keys, browser-saved passwords and Telegram session data to attackers, not just losing access to a paid charting feature. Traders who sought a free workaround now face a stronger incentive to buy legitimate subscriptions, run antivirus scans, and move funds to hardware wallets rather than keep keys in browser extensions. The scammer behind the X account gains stolen credentials; careless downloaders lose wallet control.

Infostealers hidden in cracked software remain one of the simplest ways to compromise a crypto user, because the theft happens outside any blockchain protocol and no smart contract audit can catch it. Rotating command servers through Telegram and Steam shows attackers exploiting mainstream platforms as infrastructure, which complicates takedown efforts. The episode is a reminder that self-custody's security depends entirely on the device and habits of the person holding the keys.

SlowMist's alert carries no confirmed victim count or theft figures yet, so the real scale of this campaign is still unknown. Watch whether SlowMist or other researchers publish wallet-drain evidence tied to this sample, and whether the flagged X account or its command infrastructure gets suspended. A rise in reported losses would confirm active exploitation; silence would suggest the warning mainly served as preventive disclosure.

Market reaction i

Total crypto marketall crypto assets combined no single asset in the event: read against the whole market

The total crypto market fell 1.8% in the 4 hours after the first headline, after falling 0.3% in the 2 hours before.

$2.5T market cap at the headline
-0.3% 2 h before
-1.8% 4 h after
+1.5% 12 h after
First headline

48 prices, one every 30 minutes

Coverage timeline

Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.

first
Nov 9 04:13
+8 h 42 m
Nov 9 12:55
CR Cryptopolitan context
Its angle: unsuspecting, powershell, developer; with quotes
+8 h 42 m
Nov 9 12:55
The Cryptocurrency Post context
Its angle: distributed, compromised, substantial; with quotes
+13 h 24 m
Nov 9 17:38
The Crypto Guardian echo
No new facts: infrastructure, distributing, transmitting; with quotes
+20 h 22 m
Nov 10 00:35
CP CryptoPotato echo
No new facts: educational, themselves, identifies; with quotes

Other recent incidents

WhenWhat happenedFigure
1 days ago Initia · Private key leak incident $615k
2 days ago Swarm · Supply chain attack incident no figure in dollars
2 days ago Ankr Bridge · Cross-Chain Message Spoofing incident $304.5k
3 days ago ACryptoS · Missing Input Validation incident $665.4k
3 days ago LNbits · Software vulnerability incident $1.7k

4296 incidents stored