Hackers Use Claude, Gemini and Kimi AI to Identify Wealthy Crypto Wallet Owners

Summary

• Cybercriminals use VOLTA malware and AI models, including Claude, Gemini, and Kimi to identify wealthy cryptocurrency holders and steal credentials.
• Cisco Talos researchers revealed that VOLTA extracts wallet recovery phrases, payment information, and email records to assess victims’ financial value.
• Binance restored cryptocurrency withdrawals across supported networks following its $6.3 billion hack, reporting approximately 95% recovery of affected assets.

Cybercriminals are using artificial intelligence models to identify cryptocurrency holders with valuable assets through Windows malware known as VOLTA-AUTODOXER. The malware collects sensitive financial information and evaluates victims before attackers decide which accounts or digital assets to target.

According to cybersecurity researchers at Cisco Talos, VOLTA combines information theft with AI-powered analysis to identify financially attractive victims. Its capabilities extend beyond traditional credential theft, allowing attackers to examine cryptocurrency holdings, spending patterns, and personal financial records.

Security researcher Ryan Fetterman detailed how the malware gathers information from compromised computers and processes the findings through external AI services. This approach allows cybercriminals to assess potential victims without manually reviewing large amounts of stolen information.

VOLTA specifically targets cryptocurrency wallet data, including recovery seed phrases and encrypted wallet vaults stored on infected Windows devices. Attackers could potentially use exposed recovery phrases to access digital assets without obtaining additional authorization from wallet owners.

Besides cryptocurrency credentials, the malware collects saved browser passwords, payment card information, authentication tokens, and email login details. It also targets active sessions across Telegram, Discord, Steam, and Roblox, expanding the amount of information available to attackers.

VOLTA Malware Uses Claude, Gemini and Kimi AI to Rank Valuable Crypto Targets

Cisco Talos researchers discovered that VOLTA connects with several artificial intelligence models through OpenRouter, a service providing access to multiple AI systems. The malware initially submits collected victim information to Anthropic’s Claude Opus 4.6 for financial analysis and profiling.

If Claude rejects the request, VOLTA attempts to process the information through Moonshot AI’s Kimi K2 model. Google’s Gemini 2.5 Flash serves as another alternative when earlier attempts fail or produce refusal responses.

Significantly, the malware checks for AI refusal messages before switching models, allowing its automated analysis process to pursue alternative services. Researchers found that VOLTA instructs these models to evaluate victims’ financial standing and identify potentially profitable assets.

The AI-generated assessments can rank stolen information according to financial value while evaluating weaknesses in each victim’s cybersecurity arrangements. Such profiling helps attackers identify cryptocurrency holders whose accounts or stored credentials could offer greater financial rewards.

Hackers Extract Financial Records and Personal Data to Build Victim Profiles

Meanwhile, VOLTA also examines email accounts and professional communications to build more detailed profiles of compromised users. Its collection capabilities cover Outlook accounts, Slack workspaces, and information stored within connected Gmail accounts.

Researchers identified searches for purchase confirmations and payment receipts involving Amazon, PayPal, Walmart, DoorDash, and Uber Eats. These records can reveal residential addresses, employment details, purchasing behavior, and other information relevant to a victim’s financial profile.

Additionally, access to payment histories and cryptocurrency credentials allows attackers to combine financial indicators with potentially exploitable account information. This combination distinguishes VOLTA from conventional information stealers that primarily collect credentials for later exploitation.

Binance Restores Crypto Withdrawals Following $6.3 Billion Security Breach

Binance has begun restoring cryptocurrency withdrawals following a $6.3 billion security breach that disrupted transactions across several blockchain networks. The exchange confirmed a phased reopening covering 15 networks, including Bitcoin, Ethereum, XRP Ledger, Solana, BNB Smart Chain, and Dogecoin.

As reported by 36Crypto, withdrawal demand influenced the selection of cryptocurrencies included in the initial restoration phase. Additional supported networks include Avalanche, Sui, Polygon, Arbitrum, and Zcash, alongside stablecoins USDT and USDC.

Meanwhile, Binance reported recovering or restoring approximately 95% of affected assets, improving from its previously disclosed 90% coverage level. The exchange committed more than $6.34 billion in company funds to cover losses resulting from the security incident. Binance also confirmed full asset backing for major cryptocurrencies, including XRP, Bitcoin, Ethereum, Solana, and BNB.

The Binance breach highlights cryptocurrency security risks, while Cisco Talos findings document another method attackers use to identify valuable targets. VOLTA’s integration of AI-powered financial profiling demonstrates how stolen personal information can support cryptocurrency theft operations.