A wallet stealer is malware built to capture cryptocurrency wallet material such as seed phrases, private keys, recovery codes, or browser-stored wallet data. Once stolen, that material can let an attacker impersonate the victim and move funds without needing to break encryption or bypass the wallet itself.
Wallet stealers matter because they target the weakest point in many crypto workflows: the endpoint. They often arrive through phishing, fake browser extensions, malicious installers, or compromised developer tools. In real attacks, the malware may search local files, browser profiles, clipboard data, or extension storage for wallet artifacts, then exfiltrate them to an attacker-controlled server. Defenders reduce the risk by keeping wallets in dedicated environments, using hardware wallets, limiting browser access to wallet secrets, auditing extensions, and rotating keys quickly if a machine is suspected to be compromised.