SlowMist Flags 'Cracked TradingView Premium' as Wallet-Data Malware
- Published
- Updated
SlowMist identified a Windows sample branded as a cracked version of TradingView Premium that it says is actually malware. The campaign is aimed at browser credentials, wallet data, and messaging access, and SlowMist says similar scams have been circulating for about 18 months.
Key claims & sources
What it means
TradingView is a charting and market-analysis platform that many crypto traders use alongside wallets, exchanges, and messaging apps. A fake premium crack matters because it turns a software-search habit into a security risk for the same tools traders rely on to manage accounts and communicate. SlowMist’s warning sits squarely in the long-running pattern of malware bundled as free or pirated software in crypto-adjacent communities.
For people who install unofficial builds, the immediate practical effect is exposure of credentials and session data rather than just a broken app. Wallet holders, browser users, and Telegram users would need to treat a suspicious TradingView download as a potential account-compromise event, not a convenience shortcut. Builders and community operators also have to assume that distribution channels on X can be used to push malicious files under familiar brand names.
The trade-off here is between open, informal software sharing and the security discipline crypto users need to protect keys and sessions. Crypto tools are already a high-value target, and a fake TradingView package shows how attackers can sit between analysis, custody, and communication workflows. That tension is especially sharp in markets where traders move quickly and may be tempted by cracked software that looks familiar.
SlowMist said the broader scam pattern has been running for about 18 months, but the exact operators behind the X account were not identified. The public details still leave open whether the same group is behind earlier versions of the lure or whether this is a new distribution channel using an old trick. Confirmation would require identifying the account, tracing the malware sample, and seeing whether other fake premium builds were posted from the same network.
Market reaction i
The total crypto market fell 1.8% in the 4 hours after the first headline, after falling 0.3% in the 2 hours before.
43 prices, one every 30 minutes
Coverage timeline
Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.
Other recent incidents
| When | What happened | Figure |
|---|---|---|
| today | Ankr Ethereum Cross-chain Bridge · Smart contract vulnerability incident | $304.5k |
| 2 days ago | ACryptoS · Smart contract vulnerability incident | $665.4k |
| 2 days ago | LNbits · Software vulnerability incident | $1.7k |
| 4 days ago | Keplr Wallet · Supply chain attack incident | $6M |
| 4 days ago | Degen Coin Flip · Smart contract vulnerability incident | $10k |
4290 incidents stored