Key Highlights
- Blockchain security firm SlowMist has issued a warning regarding a fake, reverse-engineered TradingView software being promoted on social media to spread malware.
- The campaign, pushed by the X account @cryptotrice since mid-October, lures users with promises to bypass license checks through compromised third-party websites.
- Victims are urged to immediately disconnect affected devices, transfer cryptocurrency assets to new wallets using uncompromised hardware, and reset all critical credentials.
SlowMist Uncovers Fake TradingView Desktop App Campaign
Blockchain security firm SlowMist has detected an active malware distribution campaign masquerading as a cracked version of TradingView, the widely used market charting and analysis platform. Threat actors have been promoting purported reverse-engineered versions of the desktop software that promise to bypass license verification checks, placing cryptocurrency traders and retail investors at risk of compromised credentials and asset theft.
According to SlowMist, an X account operating under the handle @cryptotrice has been repeatedly pushing the fraudulent setup files since mid-October. Several promotional posts regarding the cracked software have garnered significant reach, with individual posts amassing over 300,000 views across the platform.
Anatomy of the Exploit: KeyGens and Compromised Domains
The distribution scheme relies on an instructional guide published by the @cryptotrice account on October 17, which claims to offer traders an avenue to bypass TradingView’s native license verification checks. The guide instructs users to download and extract a password-protected archive file, execute a desktop binary, and generate an unauthorized license key using an included KeyGen tool.
To establish a false sense of legitimacy, the tutorial claims that official GitHub and Discord links are embedded directly inside the software interface. In a follow-up reply on November 6, the @cryptotrice account attempted to justify the absence of a public codebase by claiming that the repository was kept private and could only be accessed directly through the application itself.
Kraken Parent Payward Says Expansion Beyond Crypto Trading Is Cushioning Revenue Decline
Despite claiming an association with development platforms, the download hyperlinks do not resolve to GitHub. Instead, SlowMist discovered that the links point users to an external domain, halchemicals[.]com. Furthermore, the cybersecurity firm identified another distribution point, arche-hypnose[.]com, noting that it appeared to be a legitimate, previously existing website that had been compromised by attackers to serve as a malware delivery node.
Recommended Remediation Steps for Exposed Traders
For any users who downloaded or executed the purported reverse-engineered TradingView application, SlowMist recommends undertaking rapid containment measures. The security firm advised anyone who had already run the software to disconnect the affected device from the network immediately to sever active connections to remote command-and-control servers.
SlowMist additionally urged compromised users to transfer any cryptocurrency holdings using a separate, clean device into a brand-new wallet generated with a fresh seed phrase. Remediation guidance also includes executing comprehensive credential resets—specifically changing passwords across web browsers, cryptocurrency exchanges, primary email services, and Telegram accounts—as well as terminating all active Telegram sessions.
Why This Matters
Cryptocurrency traders frequently rely on advanced charting suites and technical indicators, making high-tier subscriptions to tools like TradingView high-value targets for social engineering. Malware distributors increasingly weaponize fraudulent software cracks and utility clones to harvest private keys, seed phrases, and active session tokens directly from local systems.
TradingView delivers its official software exclusively through its legitimate desktop downloads directly on its own website. Users attempting to obtain unauthorized cracked versions circumvent security safeguards, routinely exposing local machines to arbitrary code execution, remote access trojans (RATs), and direct financial theft.
Frequently Asked Questions
How does the fake TradingView software compromise user devices?
The campaign prompts users to download a password-protected archive file from compromised domains, such as halchemicals[.]com and arche-hypnose[.]com. Once extracted and executed under the guise of running a KeyGen utility, the program can execute malicious code locally, placing crypto wallets and stored credentials at risk.
What should you do if you installed the malicious software?
Users who executed the file should immediately disconnect the device from the internet. From a clean, separate machine, users should transfer all assets to a newly generated wallet with a new seed phrase, change passwords for email, exchange, browser, and Telegram accounts, and revoke any active Telegram sessions.
Where can users safely obtain the official TradingView software?
TradingView provides legitimate desktop applications solely through its own official website. Any third-party channels, private GitHub repositories, or password-protected archives offering bypassed licensing features should be treated as untrusted and potentially malicious.
