A common claim is spreading on crypto social media today: free access to premium trading tools without needing a subscription. SlowMist reports that this offer, cracked TradingView premium does not actually unlock premium features.
Instead, cracked TradingView premium is a Windows infostealer designed to collect sensitive information and send it to attackers.TradingView is widely used by traders to monitor Bitcoin, Ethereum, stocks, and derivatives. If the charting tool is compromised, it could provide access to exchange accounts, browser sessions, wallets, and private communications.
What SlowMist Discovered in the Cracked Installer
SlowMist noted that the Cracked TradingView Premium campaign has been since mid-October by the X account @cryptotrice, with some posts receiving over 300,000 views. The install process for cracked TradingView premium involves downloading a password-protected archive and creating a license code via a KeyGen. The author told BleepingComputer the project was open source on GitHub, although SlowMist found the download link did not lead to GitHub.
In , the author stated it had set the repository to private and only linked through the download. SlowMist confirmed the Windows sample collects data from browsers, crypto wallets and Telegram and sends it out using WinINet, rotating command-and-control servers over Telegram and Steam using hardcoded domains to avoid IP filtering.
The site for delivery, arche-hypnose[.]com, is a compromised website that was not suspicious until revealed by SlowMist. The macOS link returned a 404 so no macOS sample was obtained.
Also Read: Russia Telegram Investigation Intensifies After Terrorism Case Against Pavel Durov
Why This Threat Reaches Beyond One Account
The immediate victims are traders who installed cracked TradingView premium, but the impact can extend further. Stolen browser credentials can expose exchange accounts, email, and cloud services. Stolen Telegram data can enable impersonation and phishing of trusted contacts. Wallet data can cause asset loss, in particular if seed phrases or private keys are exposed.
For exchanges and wallet providers, the incident supports that security depends not only on two-factor authentication and withdrawal allowlists, but also on endpoint hygiene. For security teams, the use of legitimate platforms for command-and-control rotation shows why domain blocking alone is insufficient. The campaign fits a broader pattern.
Infostealers such as Lumma, Vidar, and Atomic Stealer, known as AMOS, have repeatedly been distributed through fake trading tools and cracked software. Malwarebytes previously documented a TradingView-related lure on distributing Lumma on Windows and AMOS on macOS, with victims reporting emptied wallets. Hexastrike later published a 2026 variation using Vidar on Windows and AMOS on Mac.
Also Read: Telegram Rolls Out Crypto Wallet to 1 Billion Users
What Users and Industry Should Do
SlowMist warned people who had run the software to act quickly: disconnect, transfer assets to a clean device with a fresh wallet and seed phrase, change passwords to browsers, exchanges, email, and Telegram, and close any active Telegram sessions.
If an infostealer executes, passwords, and sessions are compromised regardless of whether there is any actual loss. Users should only download Trading View from the website, Google Play or iOS app stores and stay far away from crack versions, KeyGens and Archivers with passwords from sources who cannot be trusted.
Platforms can do a better job reporting scams and warning for dangerous links. “The cracked TradingView premium campaign failed because the malware was new. It succeeded because it provided traders with what they wanted in a familiar language to make it seem trustworthy. In crypto, where self-custody has serious financial repercussions, this is the most critical line of defense.”
Also Read: Telegram Ban: Durov vs Reliance Blocking Claims 2026
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
