SlowMist Flags 'Cracked TradingView Premium' as Wallet-Data Malware

44Importance
updatingStatus
3News media
Published
Updated

SlowMist identified a Windows sample branded as a cracked version of TradingView Premium that it says is actually malware. The campaign is aimed at browser credentials, wallet data, and messaging access, and SlowMist says similar scams have been circulating for about 18 months.

Key claims & sources

✓
SlowMist said an X account is sharing malware disguised as a “cracked” TradingView Premium download.
✓
The fake TradingView Premium crack is intended to steal private keys, browser logins, and messaging sessions, according to SlowMist.
✓
SlowMist described a Windows sample labeled “Cracked TradingView Premium” as an infostealer.
✓
The sample can collect browser credentials, crypto wallet data, and Telegram information, according to SlowMist.

What it means

TradingView is a charting and market-analysis platform that many crypto traders use alongside wallets, exchanges, and messaging apps. A fake premium crack matters because it turns a software-search habit into a security risk for the same tools traders rely on to manage accounts and communicate. SlowMist’s warning sits squarely in the long-running pattern of malware bundled as free or pirated software in crypto-adjacent communities.

For people who install unofficial builds, the immediate practical effect is exposure of credentials and session data rather than just a broken app. Wallet holders, browser users, and Telegram users would need to treat a suspicious TradingView download as a potential account-compromise event, not a convenience shortcut. Builders and community operators also have to assume that distribution channels on X can be used to push malicious files under familiar brand names.

The trade-off here is between open, informal software sharing and the security discipline crypto users need to protect keys and sessions. Crypto tools are already a high-value target, and a fake TradingView package shows how attackers can sit between analysis, custody, and communication workflows. That tension is especially sharp in markets where traders move quickly and may be tempted by cracked software that looks familiar.

SlowMist said the broader scam pattern has been running for about 18 months, but the exact operators behind the X account were not identified. The public details still leave open whether the same group is behind earlier versions of the lure or whether this is a new distribution channel using an old trick. Confirmation would require identifying the account, tracing the malware sample, and seeing whether other fake premium builds were posted from the same network.

Market reaction i

Total crypto marketall crypto assets combined no single asset in the event: read against the whole market

The total crypto market fell 1.8% in the 4 hours after the first headline, after falling 0.3% in the 2 hours before.

$2.5T market cap at the headline
-0.3% 2 h before
-1.8% 4 h after
-0.6% 9 h after (so far)
First headline

43 prices, one every 30 minutes

Coverage timeline

Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.

first
Nov 9 04:13
+8 h 42 m
Nov 9 12:55
CR Cryptopolitan context
Its angle: unsuspecting, powershell, installed; with quotes
+8 h 42 m
Nov 9 12:55
The Cryptocurrency Post context
Its angle: compromised, information, distributed; with quotes

Other recent incidents

WhenWhat happenedFigure
today Ankr Ethereum Cross-chain Bridge · Smart contract vulnerability incident $304.5k
2 days ago ACryptoS · Smart contract vulnerability incident $665.4k
2 days ago LNbits · Software vulnerability incident $1.7k
4 days ago Keplr Wallet · Supply chain attack incident $6M
4 days ago Degen Coin Flip · Smart contract vulnerability incident $10k

4290 incidents stored