Arkanix stealer, likely built with LLM help, targeted crypto wallets before its makers shut it down
People infected with the Arkanix stealer (Exodus, Atomic and browser wallet users)
Kaspersky analysed Arkanix, a malware-as-a-service info-stealer advertised on dark-web forums and Discord from October 2025, as Security Affairs reported on 24 February 2026. It took crypto wallet data, with paid builds offering injection into Exodus and Atomic wallets, along with browser passwords, cookies, Telegram sessions and Discord logins. Kaspersky says the code shows probable traces of LLM-assisted development, and the operators shut the project down about two months after launch. No victim counts or losses were published.
Why this severity: A warning with little reported loss.
AI involvement
AI-built malware. Kaspersky says the stealer contains probable traces of LLM-assisted development and was likely an AI-assisted experiment.
Check that a package, extension or app is the real one before installing it, even when an AI assistant suggested it.
- Started
- Feb 24, 2026
- Closed
- Feb 24, 2026
- Chains
- Multiple EVM chains
At risk
- People infected with the Arkanix stealer (Exodus, Atomic and browser wallet users)
- Multiple EVM chains wallets
What to do now
- From a clean device, move funds from Exodus, Atomic and browser-extension wallets to new seed phrases.
- Change passwords, log out Telegram and Discord sessions everywhere and turn on 2FA.
Stay safe
Am I affected?
If your security software flagged Arkanix, or you ran an unknown 'tool', crack or game file from Discord or a forum in late 2025, assume wallet files and browser logins on that computer were stolen.
What to do now
- From a clean device, move funds from Exodus, Atomic and browser-extension wallets to new seed phrases.
- Change passwords, log out Telegram and Discord sessions everywhere and turn on 2FA.
How to avoid this
- Do not run cracked software or free 'tools' from Discord servers.
- Keep large holdings on a hardware wallet; desktop wallets are a stealer's first target.
Timeline 1
Security Affairs reported Kaspersky's analysis of Arkanix and the project's shutdown.
Source
News & write-ups ›1
Follow new drains and updates in your feed reader or Telegram RSS bot.