Traders trying to save on a TradingView subscription risk losing funds in crypto wallets and exchange accounts. Since mid-October, a malicious program—an infostealer that steals passwords, wallet data, and Telegram credentials—has been distributed under the guise of a "cracked" version of TradingView Premium.
Retail traders are primarily at risk: TradingView is popular as a chart analysis tool, and the paid tier unlocks more indicators and charts on a single tab. Users who have already installed the pirated version can preserve their funds if they promptly transfer them to a new wallet; everyone else simply needs to avoid downloading cracked applications.
How the pirated TradingView scheme works
Since mid-October, the X account cryptotrice has been actively promoting a supposedly cracked version of TradingView Premium that bypasses license verification. Some of these posts have garnered over 300,000 views, and to install it, users must download a password-protected archive and obtain a license code in a KeyGen window.
The author claimed that the project's source code was open on GitHub, but the download address did not lead to GitHub. He also wrote in replies that the repository had been made private and that download links were available only in the app and valid only once. Several users noted in the comments that this looked like malicious software for stealing accounts and crypto wallets, and one reported that their antivirus deleted the file immediately after unpacking.
Analysis of the Windows version confirmed: it is an infostealer. The program collects logins and passwords saved in browsers, crypto wallet data, and Telegram credentials, then sends them to the attackers' command server. The virus also retrieves and changes the addresses of such servers via Telegram and Steam.
The malicious files are distributed from the arche-hypnose website—apparently a legitimate resource that was hacked. The page with the macOS version currently returns a 404 error, so no sample for that system has been obtained yet.
Where else users risk money and data
The same appeal to the desire to save money underlies the ChatGPT Plus subscription scam that was warned about on November 3: fraudsters create Telegram chatbots for paying for foreign subscriptions and, after card details are entered, charge the entire amount from the account.
As in the TradingView case, much depends on the source from which the user obtains the software or device. On October 30, experts compared incidents involving hardware wallets and recalled the backdoors in Ledger devices from reseller CryptoBilis, advising users to buy wallets only from the manufacturer and to avoid Coldcard and Keystone.
Scammers also operate without viruses: on November 1, schemes involving fake jobs abroad were described, where the victim is asked to set up a crypto wallet and buy cryptocurrency supposedly to confirm funds for a visa. As a result, the person risks not only losing their savings but also becoming a transit link in the scheme and facing charges of complicity.
Victims of the pirated TradingView are advised to change passwords in browsers, on exchanges, in email, and in Telegram, terminate active sessions in the messenger, and transfer assets to a clean device with a new wallet and seed phrase. Cracked programs, key generators, and password-protected archives remain one of the most common ways infostealers are distributed.
Cryptalist analysis: The incident demonstrates the resilience of the classic social engineering model, where exploiting the desire to save on legitimate services gives attackers direct access to keys and exchange accounts. For institutional market participants, this is a signal of the need for a strict device management policy and a ban on unofficial software in trading environments. For the retail segment, the growth of such schemes threatens not only direct losses but also a decline in trust in the ecosystem as a whole.