SlowMist Flags 'Cracked TradingView Premium' as Wallet-Data Malware

A Windows program promoted on X as a “cracked” version of TradingView Premium collects browser credentials, crypto wallet data and Telegram data, blockchain security firm SlowMist warned.

“We analyzed it and confirmed the Windows sample is an infostealer,” the firm wrote in its alert. It said the malware sends the information to attacker-controlled servers and uses Telegram and Steam to find and switch those servers.

The alert did not document a confirmed theft or provide a victim count. SlowMist said the advertised macOS download returned a 404 error, so it had not obtained a sample for that operating system.

SlowMist said the X account @cryptotrice had repeatedly promoted the purported reverse-engineered software since mid-October, with some posts exceeding 300,000 views.

The account's Oct. 17 guide claims to bypass TradingView's license checks. Its installation instructions call for extracting a password-protected archive, running a desktop program and generating a license code through a KeyGen. The guide places purported GitHub and Discord links inside the app; the account said in a Nov. 6 reply that the repository was private and accessible only through the apps.

The guide's download links point to halchemicals[.]com rather than GitHub. SlowMist separately identified arche-hypnose[.]com as a download site and said it appeared to be a legitimate website compromised to distribute the malware.

What Exposed Users Should Do

SlowMist advised anyone who had already run the software to disconnect the affected device from the network immediately. It recommended moving assets using a clean device to a new wallet with a new seed phrase, changing browser, exchange, email and Telegram passwords, and terminating active Telegram sessions.

TradingView, a charting platform, provides its legitimate desktop downloads through its own website.