CrashStealer access to cryptocurrency wallet data (wallet.dat, Exodus/Electrum/Ledger Live)

Duo Tech@duotech

•updated Jul 14, 2026•1•0•2

Detects read, creation, or modification events involving common cryptocurrency wallet files (e.g., wallet.dat) or directories associated with wallet applications (Exodus, Electrum, Ledger Live) located within user application support directories. This behavior is indicative of credential access attempts where an adversary is trying to steal private keys or wallet data.