9,714 CRYPTON_LOGS 299PC: Crypto Credentials Leaked Nov 2025

We've been tracking a worrying uptick in stealer log dumps on Telegram channels frequented by initial access brokers. What really struck us about this particular dump wasn't the volume – just under 10,000 records – but the composition. It wasn't the usual collection of random credentials; this set, which we've dubbed “CRYPTON_LOGS 299PCS," appeared to be specifically harvested from systems accessing cryptocurrency-related services, exposing API keys, hostnames and email addresses. The plaintext passwords further amplify the risk, potentially granting immediate access to cryptocurrency wallets and exchanges. This targeting suggests a shift towards more focused credential harvesting campaigns aimed at high-value targets within the cryptocurrency ecosystem.

CRYPTON_LOGS: Targeted Stealer Log Exposes Crypto Credentials

A Telegram user uploaded the **CRYPTON_LOGS 299PCS** stealer log file on **November 17, 2025**, exposing **9,714** records. The data included **email addresses, plaintext passwords, and URLs**, suggesting the stealer targeted specific applications or browser activity related to cryptocurrency services. The file's structure points to a typical stealer log format, likely collected from compromised endpoints via malware designed to extract credentials and other sensitive information. What caught our attention was the clear targeting of cryptocurrency-related activity, indicated by the URLs and the overall file naming convention, suggesting a deliberate effort to compromise accounts within this sector. This breach matters to enterprises involved in cryptocurrency, blockchain technology, or related financial services, as it highlights the increasing risk of targeted credential harvesting and the potential for significant financial losses. This incident aligns with the broader trend of automated attacks leveraging stealer logs readily available on platforms like Telegram.

Breach Stats:
* Total records exposed: **9,714**
* Types of data included: **Email Addresses, Plaintext Passwords, URLs**
* Sensitive content types: Potentially cryptocurrency wallet access, exchange API keys, and related financial information.
* Source structure: Stealer log file (likely JSON or similar format).
* Leak location(s): Telegram channel.
* Date of first appearance: **November 17, 2025**

There's been an increase in stealer logs being sold on Telegram channels, often grouped by target or application. For instance, a recent report by BleepingComputer highlighted the growing trend of infostealers targeting cryptocurrency wallets and exchanges. These logs are often packaged and sold as "initial access" points for further exploitation. One Telegram post claimed these files were specifically "collected from endpoints accessing crypto trading platforms." This kind of targeted harvesting is a growing problem, demonstrating the increasing sophistication of threat actors in the cryptocurrency space.