Massive Malware Dataset Exposes 420,000 Accounts

Home » Crypto News

A leaked dataset of 149M stolen credentials reportedly includes login details for around 420,000 Binance accounts.

‘;
}
function loadTrinityPlayer(targetWrapper, theme,extras=””) {
cleanupPlayer(targetWrapper); // Always clean first ✅
targetWrapper.classList.add(‘played’);
// Create script
const scriptEl = document.createElement(“script”);
scriptEl.setAttribute(“fetchpriority”, “high”);
scriptEl.setAttribute(“charset”, “UTF-8”);
const scriptURL = new URL(`https://trinitymedia.ai/player/trinity/2900019254/?themeAppearance=${theme}${extras}`);
scriptURL.searchParams.set(“pageURL”, window.location.href);
scriptEl.src = scriptURL.toString();
// Insert player
const placeholder = targetWrapper.querySelector(“.add-before-this”);
placeholder.parentNode.insertBefore(scriptEl, placeholder.nextSibling);
}
function getTheme() {
return document.body.classList.contains(“dark”) ? “dark” : “light”;
}
// Initial Load for Desktop
if (window.innerWidth > 768) {
const desktopBtn = document.getElementById(“desktopPlayBtn”);
if (desktopBtn) {
desktopBtn.addEventListener(“click”, function () {
const desktopWrapper = document.querySelector(“.desktop-player-wrapper.trinity-player-iframe-wrapper”);
if (desktopWrapper) loadTrinityPlayer(desktopWrapper, getTheme(),’&autoplay=1′);
});
}
}
// Mobile Button Click
const mobileBtn = document.getElementById(“mobilePlayBtn”);
if (mobileBtn) {
mobileBtn.addEventListener(“click”, function () {
const mobileWrapper = document.querySelector(“.mobile-player-wrapper.trinity-player-iframe-wrapper”);
if (mobileWrapper) loadTrinityPlayer(mobileWrapper, getTheme(),’&autoplay=1′);
});
}
function reInitButton(container,html){
container.innerHTML = ” + html;
}
// Theme switcher
const destroyButton = document.getElementById(“checkbox”);
if (destroyButton) {
destroyButton.addEventListener(“click”, () => {
setTimeout(() => {
const theme = getTheme();
if (window.innerWidth > 768) {
const desktopWrapper = document.querySelector(“.desktop-player-wrapper.trinity-player-iframe-wrapper”);
if(desktopWrapper.classList.contains(‘played’)){
loadTrinityPlayer(desktopWrapper, theme,’&autoplay=1′);
}else{
reInitButton(desktopWrapper,’Listen‘)
const desktopBtn = document.getElementById(“desktopPlayBtn”);
if (desktopBtn) {
desktopBtn.addEventListener(“click”, function () {
const desktopWrapper = document.querySelector(“.desktop-player-wrapper.trinity-player-iframe-wrapper”);
if (desktopWrapper) loadTrinityPlayer(desktopWrapper,theme,’&autoplay=1’);
});
}
}
} else {
const mobileWrapper = document.querySelector(“.mobile-player-wrapper.trinity-player-iframe-wrapper”);
if(mobileWrapper.classList.contains(‘played’)){
loadTrinityPlayer(mobileWrapper, theme,’&autoplay=1′);
}else{
const mobileBtn = document.getElementById(“mobilePlayBtn”);
if (mobileBtn) {
mobileBtn.addEventListener(“click”, function () {
const mobileWrapper = document.querySelector(“.mobile-player-wrapper.trinity-player-iframe-wrapper”);
if (mobileWrapper) loadTrinityPlayer(mobileWrapper,theme,’&autoplay=1′);
});
}
}
}
}, 100);
});
}
})();

Summarize with AI

A trove of 149 million stolen credentials, including login details for 420,000 Binance accounts, was discovered circulating among cybercriminals this week.

The findings highlight a shift in crypto theft toward long-term malware infections that steal data directly from users’ devices, often long before any funds are moved.

The Scale of the Threat

According to an alert posted on February 4 by security firm Web3 Antivirus, the dataset was compiled from information-stealing malware installed on victim devices. Beyond exchange logins, the stolen data included passwords, private keys, API keys, and browser session tokens for email, social, and financial platforms.

The firm noted that these “infostealers” capture data that can later be used for account takeovers and fund theft, emphasizing that prevention requires early detection at the device level since by the time suspicious activity appears on-chain, it is often too late.

Furthermore, in a separate series of posts, Web3 Antivirus detailed how malicious AI skills on platforms like ClawHub are being used to steal crypto data. Per the security firm, these fraudulent skills, posing as wallet tools or trading bots, install information-stealing malware that can remain dormant until a victim’s crypto balance grows or specific actions are taken. This vulnerability represents a supply-chain risk that moves upstream “from wallets to the tools people trust to manage them.”

A Persistent Challenge for Users and Platforms

The gravity of losses resulting from crypto theft cannot be understated. A recent report from PeckShield noted that scams and hacks drained over $4.04 billion in 2025, with scams alone jumping 64% year-over-year. The firm observed a move toward targeting centralized exchanges and large organizations, which accounted for 75% of stolen funds in 2025.

Meanwhile, Web3 Antivirus put the volume of 2025’s illicit crypto activity at approximately $158 billion, up from $64 billion in 2024. While the on-chain security provider partly attributed the increase to better tracking and more state-linked activity, the figures show that even small success rates for thieves can result in large losses at scale.