SlowMist Warns of Infostealer Disguised as Cracked TradingView Premium
Security firm SlowMist flagged a cracked TradingView Premium build promoted on X since mid-October as Windows malware that harvests browser logins, wallet data and Telegram information. The company has not confirmed any thefts or a victim count, and its macOS analysis remains incomplete.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
What SlowMist Found
Security firm SlowMist says a cracked version of TradingView Premium, promoted on X since mid-October, is a Windows infostealer. According to SlowMist's alert, the sample collects browser login details, cryptocurrency wallet data and Telegram information, then sends them to a command-and-control server via Windows' WinINet interface. The Defiant's summary of the same alert adds that the sample uses Telegram and Steam to retrieve and rotate those command servers.
The lure was free access to paid charting features. One post promoting the download passed 360,000 views, according to CryptoPotato. The promoter, who identifies on X as an on-chain developer named Cryptotrice, described a reverse-engineered build, version 3.3.0, and instructed users to run a password-protected archive and click "generate" in a KeyGen window, a tool that produces license keys.
Distribution and Deception
The promoter presented the project as open source and pointed users to a GitHub repository. SlowMist found that the download link in the promotional posts did not resolve to GitHub. When a follower asked why the repository and Discord were reachable only through the local application, the promoter said the repository had gone private and in-app links expired after one use.
SlowMist said the download site, arche-hypnose[.]com, appears to be a legitimate website that was compromised to host the malicious file. In a reply to a user asking whether the program was safe, the promoter, via Grok, claimed it was safer than the official TradingView because no credentials ever left the system. That claim is contradicted by SlowMist's analysis of the sample.
Scope and Open Questions
The sources differ on how much is known about the damage. CryptoPotato reports SlowMist's findings without a victim count, and The Defiant states plainly that the alert confirms no thefts. Neither source reports a figure for how many machines ran the software.
The macOS version is unverified. SlowMist said the macOS link returned a 404 error at the time of its analysis, so it could not obtain a sample and cannot confirm whether that build carries the same malware.
Recommended Response for Affected Users
SlowMist advises anyone who ran the program to disconnect the machine from the network and move assets to a clean device with a new wallet and seed phrase. Users should also change passwords for exchanges, browsers, email and Telegram, and end active Telegram sessions. The firm's general warning applies beyond this case: "Cracked software, KeyGens and password-protected archives are among the most common ways infostealers are distributed. Don't install them."
Related Warning
Last week SlowMist issued a separate alert about DarkSword, an exploit it said could pull wallet files and recovery phrases from iPhones that visited compromised websites. The two warnings point to the same pattern of attackers targeting wallet credentials through consumer software and browsing.
Why It Matters
For Traders
Any trader who installed a cracked TradingView build should treat their exchange and wallet credentials as exposed and rotate them now.
For Investors
Repeated infostealer campaigns targeting wallet data raise ongoing custody and operational-security risk across the sector, not just for individual users.
For Builders
Wallet and exchange developers should expect users to be targeted through compromised third-party software, so seed phrases and session tokens need protection beyond the app boundary.
This article is for information only and is not financial advice. Read the full disclaimer.
