{
 "tag": "exodus",
 "name": "Exodus",
 "group": "Wallets & apps",
 "incidents": [
  {
   "slug": "arkanix-stealer-llm-assisted-crypto-wallets-feb-2026",
   "title": "Arkanix stealer, likely built with LLM help, targeted crypto wallets before its makers shut it down",
   "url": "https://drains.watch/i/arkanix-stealer-llm-assisted-crypto-wallets-feb-2026",
   "json": "https://drains.watch/i/arkanix-stealer-llm-assisted-crypto-wallets-feb-2026.json",
   "status": "closed",
   "severity": "low",
   "threatStatus": "contained",
   "verification": "verified",
   "ai": {
    "role": "ai-malware",
    "note": "Kaspersky says the stealer contains probable traces of LLM-assisted development and was likely an AI-assisted experiment."
   },
   "chains": [
    "multi-evm"
   ],
   "method": null,
   "product": "People infected with the Arkanix stealer (Exodus, Atomic and browser wallet users)",
   "tags": [
    "multi-evm",
    "infostealer",
    "malware-as-a-service",
    "arkanix",
    "exodus",
    "atomic-wallet",
    "llm-assisted",
    "kaspersky",
    "discord",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-02-24",
   "closedAt": "2026-02-24",
   "updatedAt": "2026-02-24T12:00:00Z",
   "summary": "Kaspersky analysed Arkanix, a malware-as-a-service info-stealer advertised on dark-web forums and Discord from October 2025, as Security Affairs reported on 24 February 2026. It took crypto wallet data, with paid builds offering injection into Exodus and Atomic wallets, along with browser passwords, cookies, Telegram sessions and Discord logins. Kaspersky says the code shows probable traces of LLM-assisted development, and the operators shut the project down about two months after launch. No victim counts or losses were published."
  },
  {
   "slug": "snap-store-fake-wallet-updates-expired-domains-jan-2026",
   "title": "Hijacked Snap Store publisher accounts push fake Exodus, Ledger Live and Trust Wallet apps",
   "url": "https://drains.watch/i/snap-store-fake-wallet-updates-expired-domains-jan-2026",
   "json": "https://drains.watch/i/snap-store-fake-wallet-updates-expired-domains-jan-2026.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "bitcoin",
    "multi-evm"
   ],
   "method": "fake-app",
   "product": "Linux users installing wallet apps from the Snap Store",
   "tags": [
    "bitcoin",
    "multi-evm",
    "fake-app",
    "linux",
    "snap-store",
    "snapcraft",
    "exodus",
    "ledger",
    "trust-wallet",
    "slowmist",
    "seed-phrase",
    "expired-domain",
    "account-takeover"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-01-21",
   "closedAt": "2026-01-21",
   "updatedAt": "2026-01-21T12:00:00Z",
   "summary": "SlowMist reported that attackers re-registered expired domains belonging to established Linux Snap Store publishers, reset the publisher accounts, and pushed updates that turned trusted apps into fake Exodus, Ledger Live and Trust Wallet clients. The fake apps ask for the wallet recovery phrase and send it to the attackers. Linux users who installed wallet apps from the Snap Store should check the publisher and never type a recovery phrase into a desktop app. No loss total was published."
  }
 ],
 "changes": [
  {
   "incident": "arkanix-stealer-llm-assisted-crypto-wallets-feb-2026",
   "incidentTitle": "Arkanix stealer, likely built with LLM help, targeted crypto wallets before its makers shut it down",
   "severity": "low",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-02-24",
   "title": "Security Affairs reported Kaspersky's analysis of Arkanix and the project's shutdown.",
   "sourceUrl": "https://securityaffairs.com/188431/malware/arkanix-stealer-ai-assisted-info-stealer-shuts-down-after-brief-campaign.html",
   "url": "https://drains.watch/i/arkanix-stealer-llm-assisted-crypto-wallets-feb-2026"
  },
  {
   "incident": "snap-store-fake-wallet-updates-expired-domains-jan-2026",
   "incidentTitle": "Hijacked Snap Store publisher accounts push fake Exodus, Ledger Live and Trust Wallet apps",
   "severity": "high",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-21",
   "title": "SlowMist's CISO warns that Snap Store publisher accounts tied to expired domains are being taken over to ship fake wallet apps.",
   "sourceUrl": "https://cointelegraph.com/news/slowmist-linux-snap-store-crypto-seed-attack",
   "url": "https://drains.watch/i/snap-store-fake-wallet-updates-expired-domains-jan-2026"
  }
 ]
}