SlowMist flags fake TradingView crack that steals wallets and Telegram data

Security firm SlowMist says an X account is spreading crypto-stealing malware through a fake “cracked” version of TradingView Premium.

SlowMist says this type of scam has been running for about 18 months and is intended to steal private keys, browser logins and messaging sessions.

Who is behind the fake TradingView crack?

The security firm SlowMist has warned that an X account using the handle “cryptotrice” has been spreading a fake “cracked” version of TradingView Premium since mid-October. The firm said the software carries an infostealer. It can also drain crypto wallets and take over Telegram accounts.

TradingView is a website that traders use to view charts and study the market. The company has warned users about these “cracked” version scams for more than a year. It has also clarified that it does not sell cracked versions of its software. In 2025, it said scammers set up fake YouTube channels that pretended to be its official account.

The purpose of those channels was to direct unsuspecting viewers to a “developer version” or “cracked version” of the TradingView app. 

The “download” option for the so-called developer version was really a PowerShell command that installed a remote access trojan and then emptied victims’ wallets. TradingView says it never asks users to run command-line scripts to install its software.

Why do these scams keep coming back?

Prior to SlowMist’s warning, Bitdefender tracked a long-running ad campaign that was marketing a fake “TradingView Premium.” It started on Facebook Ads and later spread to Google Ads and YouTube.

By 2026, the same groups had moved on from “free premium” offers and were instead selling fake AI tools. Malwarebytes found a site called TradingClaw that claimed to be an AI helper for TradingView. 

Instead, the tool installed Needle Stealer, a data-stealing program written in the Go programming language. HP (NYSE: HPQ) found a fake AI crypto trading tool at tradingclaw[.]pro that hid Needle Stealer inside a program signed by Microsoft (NASDAQ: MSFT). 

This helped it slip past Windows SmartScreen, which is a built-in Windows security check, and once inside the system, the malware replaced the victim’s browser wallet extension with a harmful copy.

Needle Stealer takes browser history, cookies and saved logins. It also pulls data from apps like Telegram. It goes after desktop wallets like Ledger, Trezor and Exodus, and browser wallets like MetaMask and Coinbase Wallet (Coinbase, NASDAQ: COIN), trying to steal seed phrases. 

The malware HP found looked for seven browser wallet extensions, including Phantom. It also took any password the victim typed into a fake unlock screen. 

Notably, Cryptopolitan has previously reported on a Mac data-stealing program called Reaper. The program was hidden behind fake app download pages and, once active, went after Ledger Live, Trezor Suite and Exodus.

Flashpoint reported that 7.4 million devices were infected with infostealers in the first half of 2026. That is 27% more than in the previous six months. 1.7 billion credentials have also been stolen. 

Flashpoint ranked Vidar ahead of StealC and Lumma as the most common variants of the malware. Lumma was in the lead until a May 2025 law-enforcement takedown that seized about 2,300 command-and-control domains. 

Flashpoint also noted that Telegram has become a way to spread this kind of tool, and it is the same app Needle Stealer is built to loot.