A remote access trojan (RAT) stole more than $235,000 in cryptocurrency from hundreds of victims during a 48-hour period, in an attack reported on September 20, 2026. The campaign used credential harvesting, which captures usernames and passwords, and session manipulation, which lets attackers exploit active browser sessions to bypass authentication. The victim count indicates broad, automated distribution rather than a narrowly targeted spear-phishing campaign, although the delivery method has not been publicly identified. No malware variant, threat actor or responsible group has been named or claimed responsibility, and no law enforcement agency has publicly acknowledged an investigation. The incident highlights the risks of crypto self-custody because transactions are generally irreversible and malware controlling a device can expose access to wallets and keys. Hardware wallets reduce exposure by keeping private keys offline, but users can still approve malicious transactions on compromised computers. No recovery efforts, formal victim notifications or exchange alerts regarding suspicious inflows have been announced. Security measures cited include hardware wallets, multifactor authentication using hardware security keys instead of SMS, verified software sources, updated operating systems and reputable endpoint security tools. With no identified actor or public investigation, the potential recovery window is measured in hours rather than days and appears to have closed.