The Windows sample uses Telegram and Steam to rotate command servers. SlowMist's alert gives no confirmed thefts or victim count.

Attackers used an internal AI tool to reach wallet engineers, while persistent onchain permissions complicated containment.

Holders on both sides are promised automatic refunds at pre-attack prices, less any winnings already claimed.

The payload can alter both displayed and copied crypto deposit addresses, while its data collection extends beyond three site-specific targeting rules.

Owners of old-key devices received after Oct. 20 need additional authenticity checks, even if the wallet passes Keystone's online verification.

Recipients reported personal and purchase details in the messages; the company said Passport hardware and funds were safe.

Fake Firefox extensions targeted recovery phrases; Electrum patched a genuine-client flaw that could trick users into signing a substituted payment.

A malicious server can substitute a fake payment, then trick the user into signing it while raising the transaction fee. Developers say one user reported losing money.

Mozilla had unpublished the add-ons by Oct. 5, the security firm says. Removing them does not secure wallets whose recovery phrases were exposed.

Sumit Gupta says the flagged addresses were compromised in July 2025 and that no funds from CoinDCX’s current wallets were affected.