Malware steals over $235K in crypto from hundreds of victims in just 48 hours

A remote access trojan has stolen more than $235,000 in cryptocurrency from hundreds of victims over a 48-hour window. The attack, reported on September 20, 2026, represents low-profile, high-volume cybercrime that quietly inflicts real damage across the crypto ecosystem.

What we know about the attack

This particular campaign leveraged standard RAT capabilities, including credential harvesting and session manipulation. Credential harvesting means the malware captures usernames and passwords as victims type them. Session manipulation goes a step further, allowing attackers to piggyback on active browser sessions to bypass authentication entirely.

The victim count, numbering in the hundreds, points to a broad and automated distribution strategy rather than a carefully targeted spear-phishing operation. The specific distribution vector in this case hasn’t been publicly identified. No particular malware variant has been named. No specific threat actor or group has claimed responsibility or been attributed. And no law enforcement agency has publicly acknowledged an investigation.

Why RATs remain crypto’s quiet nemesis

RATs are effective against crypto holders for structural reasons. Most cryptocurrency transactions are irreversible. There’s no bank to call, no chargeback to file. Once funds leave your wallet, they’re gone unless the attacker makes a mistake or law enforcement gets involved quickly enough to freeze assets on a centralized exchange.

RATs also exploit a fundamental tension in crypto self-custody. If malware controls your device, the attacker effectively controls your keys. Hardware wallets mitigate this risk by keeping private keys offline, but even hardware wallet users can be vulnerable if they approve malicious transactions on a compromised machine.

The security gap that keeps growing

What’s notable about this incident is the absence of any reported response infrastructure. No recovery efforts have been announced. No formal victim notifications have gone out. No exchanges have flagged suspicious inflows tied to the stolen funds.

For individual crypto holders, hardware wallets remain the gold standard for asset storage. Multi-factor authentication should be enabled on every exchange and wallet interface, ideally using a hardware security key rather than SMS-based codes, which are vulnerable to SIM-swap attacks. Avoiding downloads from unverified sources, keeping operating systems updated, and running reputable endpoint security software can prevent the initial infection that makes everything else possible.

With no identified threat actor and no public investigation underway, the window for recovery in cases like these is measured in hours, not days, and that window appears to have already closed.

Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.