Galaxy

XRP ETF

Arthur

Zcash

Private key theft is no longer just another way hackers attack crypto users — it has become a full-fledged business, according to GK8, a crypto custody expert owned by Mike Novogratz’s crypto investment platform Galaxy Digital.
In a report <a href="https://www.gk8.io/research/your-cryptos-not-as-safe-as-you-think-how-modern-hackers-hunt-private-keys/" rel="noopener noreferrer nofollow" target="_blank">published</a> Monday, GK8 detailed how <a rel="noopener noreferrer nofollow" target="_blank">private key</a> theft has evolved into an industrialized operation, highlighting the rise of black market tools that allow perpetrators to locate and steal someone’s seed phrase.
The study pointed to several tools, such as malware infostealers and seed phrase finders, that can scan files, documents, cloud backups and chat histories to quickly extract a user’s private key, <a href="https://cointelegraph.com/news/what-happens-if-you-lose-or-break-your-hardware-crypto-wallet" rel="noopener noreferrer nofollow">effectively giving attackers full control over their assets</a>.
“For the crypto industry, using secure custody, implementing multi-step approval processes, and enforcing role separation are essential to mitigating the risk posed by this commercialized and constantly evolving threat,” the report states.
<h2 id="it-all-starts-with-malware">It all starts with malware</h2>
According to GK8, private key theft is a multi-stage process that usually begins with hackers using malware to steal large amounts of data from an infected device.
Threat actors then feed the stolen data into automated tools that rebuild seed phrases and private keys. After identifying wallets containing valuable assets, attackers assess the security measures to drain the funds.
“These applications perform high-precision mnemonic parsing, transforming raw logs into keys, and are sold for hundreds of dollars on darknet forums,” GK8 revealed in the report.
<figure><img src="https://s3.cointelegraph.com/uploads/2025-11/019a96fb-a7a1-7713-b339-72119f218ae1" title="" alt="Crypto private key theft is now big business: Here’s what to know">
 <figcaption style="text-align: center;">Seed phrase parser tools on the black market. Source: GK8 by Galaxy
 </figcaption>
</figure>
Malware infostealers, a type of malware designed to silently harvest data from victims’ devices, have been on the rise in recent years, and macOS users are not immune, according to the cybercrime threat intelligence firm Kela.
<figure><img src="https://s3.cointelegraph.com/uploads/2025-11/019a96fb-a9e1-7526-b2e3-e91a17fe0742" title="" alt="Crypto private key theft is now big business: Here’s what to know">
 <figcaption style="text-align: center;">Source: Kela
 </figcaption>
</figure>
“Once considered relatively safe due to Apple’s built-in protections, macOS devices are still a target for cybercriminals,” Kela <a href="https://www.kelacyber.com/blog/the-rise-of-macos-infostealers-tactics-trends-defenses/" rel="noopener noreferrer nofollow" target="_blank">said</a> in a report published Nov. 10, stating that macOS infostealer activity “appears to be peaking in 2025.”
<h2 id="how-users-can-protect-themselves">How users can protect themselves</h2>
Amid rising private key hacks, users can protect themselves by assuming all local device data could be compromised, <a href="https://cointelegraph.com/explained/what-is-a-seed-phrase-and-why-is-it-important" rel="noopener noreferrer nofollow" target="_self">never storing seed phrases in digital form</a>, using multiparty approval for transactions and relying on secure custody systems, GK concluded in its report.
“A healthy combination of hot, cold, and impenetrable vault storage is necessary to minimize the asset value exposed to an immediate drain,” GK8 said.
<figure><img src="https://s3.cointelegraph.com/uploads/2025-11/019a96fb-ac05-78d0-92a1-8c0fd0cbd076" title="" alt="Crypto private key theft is now big business: Here’s what to know">
 <figcaption style="text-align: center;">Source: Kela
 </figcaption>
</figure>
Kela warned that malware infostealers often rely on <a href="https://cointelegraph.com/explained/what-is-social-engineering-in-crypto-and-how-to-protect-yourself" rel="noopener noreferrer nofollow">social engineering</a>, using fake installers, <a href="https://cointelegraph.com/news/1-6m-lost-wave-crypto-address-poisonings-this-week" rel="noopener noreferrer nofollow" target="_self">poisoned ads</a>, or phishing campaigns to trick users.
Related: <a href="https://cointelegraph.com/news/arthur-hayes-zcash-shield-self-custody" rel="noopener noreferrer nofollow" target="_self">Arthur Hayes tells Zcash holders to withdraw from CEXs and ‘shield’ assets</a>
“To stay safe, users should be extremely careful with attachments and links, avoid software from untrusted sources, and resist scams that exploit macOS’ reputation for security,” Kela said.
The firm also stressed the importance of strong, unique passwords for financial apps, enabling multifactor authentication and keeping macOS and all applications up to date to prevent malware from stealing sensitive information.
Magazine: <a href="https://cointelegraph.com/magazine/strategy-michael-saylor-bitcoin-xrp-etf-debut-canary-capital-hodlers-digest/" rel="noopener noreferrer nofollow" target="_self">Saylor denies Bitcoin sell-off, XRP ETF debut tops chart: Hodler’s Digest, Nov. 9 – 15</a>

Crypto private key theft is now big business: Here’s what to know

Table of Contents

Cointelegraph

Other articles published on Nov 18, 2025

Join our free newsletter for daily crypto updates!