A suspected remote access trojan (RAT) has been linked to more than $235,000 in cryptocurrency losses over roughly 48 hours, raising fresh concerns about malware that targets users not by exploiting blockchain protocols, but by compromising the devices and sessions through which crypto is accessed. The incident surfaced publicly on September 20 after Coin Bureau warned that hundreds of users had allegedly lost crypto holdings after attackers hijacked active sessions, highlighting a vulnerability that even hardware wallets cannot completely eliminate.

How Does Session Hijacking Actually Work?

The malware campaign combines capabilities such as credential theft and session manipulation, according to reports published after the initial alert. Instead of requiring an attacker to break a wallet's cryptography, the malware compromises the environment from which the victim is already interacting with an exchange, wallet, or financial service. Session hijacking is particularly concerning because authentication does not necessarily end when a user enters a password. Browsers and applications commonly maintain authenticated sessions using cookies or tokens. If malware can obtain or manipulate those sessions, attackers may be able to interact with services as if they were the legitimate user.

The specific Ethereum address flagged in warnings, 0x7028...5887, showed approximately $130,000 worth of USDC and USDT (stablecoins, or cryptocurrencies pegged to the US dollar) arriving from 13 addresses during a September 19 observation window, alongside other token movements. The wallet's total displayed portfolio value of approximately $235,747 reflects the scale of the operation, though blockchain security researchers cautioned that initial loss estimates can change dramatically once deeper tracing is completed.

Why Are Device and Session Attacks Becoming More Common?

Crypto security discussions often focus on smart contract audits, validator security, and protocol vulnerabilities, but attackers do not need to break Ethereum itself if they can compromise the person controlling an account. That has increasingly made the user's device one of the most attractive attack surfaces. A phishing campaign covered earlier this year drained $585,000 from Ethereum users after victims were tricked into signing malicious approvals. Another address poisoning attack caused a user to lose more than $100,000 without compromising the underlying wallet software.

Even hardware wallets, which store private keys offline and are considered more secure than software wallets, do not completely eliminate this problem. A hardware device can prevent private keys from being directly extracted from an infected computer, but a compromised interface can still attempt to convince users to approve malicious transactions. Earlier this month, an Ethereum Safe lost $7.73 million in rsETH after an authorized third-party module was exploited, demonstrating how assumptions around self-custody can break down when wallet-generation or operational security fails.

How to Reduce Your Risk of Malware Compromise

Because the malware distribution method in the current campaign has not been publicly identified, users should be cautious about treating any single defensive step as sufficient. Here are key steps security experts recommend:

• Avoid Trusting a Compromised Device: The most important assumption is that a potentially compromised device should not be trusted simply because wallet passwords have been changed. If a RAT retains access to the operating system, browser, or authenticated sessions, new credentials could potentially be captured again.
• Rebuild or Examine Affected Machines: Users who suspect compromise should avoid conducting sensitive crypto activity on the affected machine until it has been properly examined or rebuilt, according to security researchers.
• Be Cautious About Installation Sources: Users should be especially cautious about installing crypto applications, browser extensions, or software from links distributed through Telegram, Discord, email, or social media. A recent SafePal customer data breach demonstrated how even leaked contact information can create opportunities for highly convincing targeted phishing attempts.

Crypto users have already faced multiple forms of malware distribution this year. Lazarus-linked malware targeted Mac users through fake meeting links and malicious instructions capable of stealing browser credentials and wallet information. More recently, a $90,000 crypto loss linked to compromised Chrome extensions demonstrated how browser-level compromise can expose passwords and seed phrases without any failure occurring at the blockchain layer itself.

For now, the most important unanswered question surrounding the reported $235,000 campaign is how the malware actually reaches victims. Until researchers identify the infection vector and malware family, the scope of the operation remains difficult to establish. The incident underscores a fundamental reality in crypto security: the strength of Ethereum's underlying protocol means little if the person controlling the wallet has been compromised at the device level.