Loading article…
New fraud scheme tricks desperate crypto owners into downloading malware that steals passwords and personal files; HP Security Lab warns of “Lost crypto
A new malware‑laden scam is circulating that pretends to recover forgotten 24‑word seed phrases, harvesting passwords, documents and photos from users who download the fake “Lost crypto wallets finder” tool [1].
| At a glance | |
|---|---|
| Scam name | “Lost crypto wallets finder – cryptocurrency recovery toolkit” |
| Target | Users who have forgotten their wallet seed phrase |
| Data stolen | Browser passwords, documents, photos, other sensitive files |
| Discovery | HP Security Lab, cited by Alex Holland |
Scammers set up counterfeit websites that promise a free “cryptocurrency recovery” program for users who have lost their seed phrase. When a victim downloads the tool, it silently installs malware that collects a wide range of personal data—including browser passwords, documents and photos—and compresses it into a zip file that is sent to the attackers [1]. The site hosting the software has already been taken down, but researchers warn that near‑identical copies can appear quickly [4].
Alex Holland of the HP Security Lab uncovered the scheme and explained that the fraud exploits the desperation of users who cannot access their wallets. He said a typical victim will search for “free cryptocurrency recovery tool,” encounter the fake offering, and unwittingly hand over their data [1][3]. The lab’s analysis confirms the malware’s capability to harvest credentials that could be used for future fraud.
Although the exact number of victims is not disclosed, the scam’s design—targeting the panic of potentially losing thousands of dollars—makes it lucrative for cybercriminals. Security experts advise users to avoid downloading any recovery software from unverified sources, to check reviews of legitimate services, and to remove any installed malware with reputable security tools, resetting passwords thereafter [1][4].
The scheme highlights a growing trend: fraudsters are shifting from attacking blockchain encryption to exploiting human psychology, turning users’ panic over lost seed phrases into a data‑theft opportunity. As long as the promise of a free recovery tool exists, the threat is likely to persist.
Coverage is mostly measured — 78 of 80 reports stay neutral.
Every Monday — the token unlocks, Fed dates & catalysts set to move crypto and markets this week. So you’re never blindsided.
Free · 3-min read · one-click unsubscribe
AI-assisted synthesis by the TrendWatcher Editorial Desk · sourced from 5 outlets · Jun 29, 2026 · How we report
It installs malware that gathers passwords, documents, photos, and other sensitive files, then zips and sends them to criminals (NewsBytes).
A New York resident was sentenced to 15 months in federal prison for impersonating crypto influencers and defrauding victims in Maryland (The Baltimore Sun).
It monitors the clipboard, replaces copied wallet addresses with attacker‑controlled ones, and extracts seed phrases and private keys from the clipboard and screen (CryptoSlate).
Americans reported $11.37 billion in losses, a 22% increase from the previous year, according to the FBI’s Internet Crime Report (CryptoSlate).
Remove the malware with reputable security software and promptly reset passwords, starting with banking accounts (NewsBytes).