# Arkanix stealer, likely built with LLM help, targeted crypto wallets before its makers shut it down

- Severity: Low · Status: Contained (past)
- Chains: Multiple EVM chains
- Started: Feb 24, 2026 · Last update: Feb 24, 2026
- Who/what: People infected with the Arkanix stealer (Exodus, Atomic and browser wallet users)
- AI involvement: AI-built malware. Kaspersky says the stealer contains probable traces of LLM-assisted development and was likely an AI-assisted experiment.

Kaspersky analysed Arkanix, a malware-as-a-service info-stealer advertised on dark-web forums and Discord from October 2025, as Security Affairs reported on 24 February 2026. It took crypto wallet data, with paid builds offering injection into Exodus and Atomic wallets, along with browser passwords, cookies, Telegram sessions and Discord logins. Kaspersky says the code shows probable traces of LLM-assisted development, and the operators shut the project down about two months after launch. No victim counts or losses were published.

## Am I affected?
If your security software flagged Arkanix, or you ran an unknown 'tool', crack or game file from Discord or a forum in late 2025, assume wallet files and browser logins on that computer were stolen.

## What to do now
- From a clean device, move funds from Exodus, Atomic and browser-extension wallets to new seed phrases.
- Change passwords, log out Telegram and Discord sessions everywhere and turn on 2FA.

## How to avoid this
- Do not run cracked software or free 'tools' from Discord servers.
- Keep large holdings on a hardware wallet; desktop wallets are a stealer's first target.

## Sources
- Arkanix Stealer: AI-assisted info-stealer shuts down after brief campaign (Security Affairs, 2026-02-24): https://securityaffairs.com/188431/malware/arkanix-stealer-ai-assisted-info-stealer-shuts-down-after-brief-campaign.html

Full record: https://drains.watch/i/arkanix-stealer-llm-assisted-crypto-wallets-feb-2026 · JSON: https://drains.watch/i/arkanix-stealer-llm-assisted-crypto-wallets-feb-2026.json

Rules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support.