SlowMist Warns 'Cracked TradingView Premium' Is Wallet-Stealing Malware

Blockchain security firm SlowMist has identified a purported "cracked" TradingView Premium desktop app as wallet-stealing malware, distributed through an X account that has promoted the fake software since mid-October. Some of the promotional posts have drawn more than 300,000 views.

The account behind the campaign is @cryptotrice. SlowMist said it had repeatedly pushed the purportedly reverse-engineered charting software across X for weeks, amassing significant reach before the warning landed.

How does the trap work?

The mechanics follow a familiar playbook. An Oct. 17 guide posted by the account claims its method bypasses TradingView's license checks. The installation process asks users to extract a password-protected archive, run a desktop program, and generate a license code through a KeyGen tool.

The guide places what it calls GitHub and Discord links inside the app itself. When pressed, the account replied on Nov. 6 that the repository was private and reachable only through the apps — a detail that should raise immediate suspicion, since legitimate open-source distribution does not hide behind locked repos.

The actual download links point to halchemicals[.]com, not GitHub. SlowMist separately flagged arche-hypnose[.]com as a second download site. The firm said the latter appears to be a legitimate website that was compromised in order to distribute the malware — meaning attackers repurposed an otherwise ordinary domain to lend the campaign credibility.

TradingView, for its part, distributes its genuine desktop software only through its own website. Anything arriving from elsewhere carries risk by default.

What should exposed users do now?

SlowMist's guidance is blunt. Anyone who has already run the software should:

• Disconnect the affected device from the network immediately.
• Move assets to a new wallet, with a newly generated seed phrase, using a clean device.
• Change passwords for browsers, exchanges, email and Telegram.
• Terminate all active Telegram sessions.

The seed-phrase step matters most. If the malware has already read a wallet's recovery phrase, moving tokens between addresses on the same compromised wallet changes nothing — the attacker simply follows the funds.

What does this change for traders?

For the crypto trading community, the campaign is a reminder that charting tools sit inside the blast radius. TradingView is standard equipment for traders, and a fake version of a professional-grade product is an efficient way to reach exactly the people holding exchange logins and self-custodied wallets on the same machine.

The compromise of a legitimate website as a delivery vector also narrows the room for error. Users who check that a download domain "looks real" can still land on malware if that domain has been quietly taken over.

The practical rule stands: software that touches a machine where wallets live should come only from the vendor's own site, and premium software offered free through KeyGen instructions is not a discount — it is the product being sold.

SlowMist's advisory gives the campaign public exposure, but the underlying X posts remain live, and the compromised distribution site's recovery timeline is unknown — leaving the door open for further infections until both are taken down.