A claim circulating across crypto social media today promises free access to premium trading tools without a subscription. According to blockchain security firm SlowMist, the offer, a so-called cracked version of TradingView Premium — software modified to bypass its paid licensing — does not actually unlock premium features. Instead, it is a Windows infostealer designed to collect sensitive information and send it to attackers. Infostealers are a class of malware built to harvest saved credentials, session data, and files from an infected device. The firm shared its findings in a threat intelligence alert posted on X on November 9, 2026.

TradingView is widely used by traders to monitor Bitcoin, Ethereum, stocks, and derivatives, and Premium is one of the platform's paid subscription tiers. If the charting tool is compromised, it could provide access to exchange accounts, browser sessions, wallets, and private communications.

What SlowMist Found in the Cracked Installer

SlowMist noted that the "Cracked TradingView Premium" campaign has been promoted since mid-October by the X account @cryptotrice, with some posts receiving more than 300,000 views, giving the lure substantial reach on the platform. The installation process involves downloading a password-protected archive and generating a license code through a KeyGen. The author told BleepingComputer that the project was open source on GitHub, although SlowMist found the download link did not lead to GitHub. In response, the author said the repository had been set to private and was accessible only through the download link.

SlowMist confirmed that the Windows sample collects data from browsers, crypto wallets, and Telegram, and sends it out using WinINet, a built-in Windows networking component. The malware rotates command-and-control servers — the remote infrastructure that receives stolen data from infected machines — over Telegram and Steam, using hardcoded domains to avoid IP filtering. The delivery site, arche-hypnose[.]com, is a compromised website that showed no signs of being suspicious until SlowMist revealed it. The macOS download link returned a 404 error, so no macOS sample was obtained, and whether a macOS variant exists remains unconfirmed.

🚨 SlowMist TI Alert: Beware of the "Cracked TradingView Premium" Infostealer 🚨 Since mid-October, X account "cryptotrice" has repeatedly promoted a so-called "reverse-engineered cracked #TradingView Premium," with some posts passing 300K views. The software requires… pic.twitter.com/SxJDx3iXwa

— SlowMist (@SlowMist_Team), November 9, 2026, via X

Why the Threat Extends Beyond One Account

The immediate victims are traders who installed the cracked software, but the impact can reach further. Stolen browser credentials can expose exchange accounts, email, and cloud services. Stolen Telegram data can enable impersonation and phishing of trusted contacts. Wallet data can cause asset loss, particularly if seed phrases — the recovery phrases that grant full control over a crypto wallet — or private keys are exposed.

For exchanges and wallet providers, the incident underscores that security depends not only on two-factor authentication and withdrawal allowlists, but also on endpoint hygiene. For security teams, the use of legitimate platforms for command-and-control rotation shows why domain blocking alone is insufficient.

The campaign also fits a broader pattern, as covered by The Street. Infostealers such as Lumma, Vidar, and Atomic Stealer (AMOS) have repeatedly been distributed through fake trading tools and cracked software. Malwarebytes previously documented a TradingView-related lure on Reddit distributing Lumma on Windows and AMOS on macOS, with victims reporting emptied wallets. Hexastrike later published a 2026 variation using Vidar on Windows and AMOS on Mac.

What Users and the Industry Should Do Next

SlowMist warned people who had run the software to act quickly: disconnect from the network, transfer assets to a clean device with a fresh wallet and seed phrase, change passwords for browsers, exchanges, email, and Telegram, and close any active Telegram sessions. If an infostealer executes, passwords and sessions should be treated as compromised regardless of whether any loss is immediately apparent.

Users should download TradingView only from the official website, Google Play, or the iOS App Store, and stay away from cracked versions, KeyGens, and password-protected archives from untrusted sources. Platforms can also do more by improving scam reporting and warning users about dangerous links.

"The cracked TradingView premium campaign failed because the malware was new. It succeeded because it provided traders with what they wanted in a familiar language to make it seem trustworthy. In crypto, where self-custody has serious financial repercussions, this is the most critical line of defense."