Malware Theft Flows: $16.6M in Feb, $30B Whale Outflows, and Price Impact

A novel attack chain is bypassing browser defenses to steal digital assets. Threat actors are weaponizing Windows File Explorer's built-in ability to connect to remote WebDAV servers, sidestepping standard download warnings entirely. This tactic, active since at least February 2024, uses phishing emails with .url or .lnk files to silently establish malicious connections, delivering remote access trojans (RATs) directly to corporate machines.

The direct financial impact is clear. In February 2026, wallet thefts caused $16.6 million in losses. This figure represents the immediate monetary drain from compromised digital wallets, a key outcome of the malware delivery chain. The StilachiRAT malware, uncovered by Microsoft, exemplifies the theft mechanism. Its capabilities include scanning for 20 different cryptocurrency wallet extensions and, critically, stealing data stored in the clipboard, a common method for hijacking copied wallet addresses or private keys.

The attack's sophistication lies in its multi-layered delivery. After initial compromise via File Explorer, scripts pull additional payloads from separate WebDAV servers, blending legitimate and malicious files to evade detection. This stealthy path ensures the final RAT payload, capable of exfiltrating sensitive data, reaches the target without triggering browser-based security tools.

Whale Outflows: The Dominant Liquidity Drain

The most significant supply overhang in the market is coming from large holders. Since October 2025, we estimate roughly $30 billion in net outflows from large holders. This massive liquidity drain has fundamentally reshaped exchange dynamics, with whales now accounting for 64% of exchange deposits. That ratio is the highest since 2015, indicating an unprecedented concentration of supply on exchanges. This concentration is a direct contributor to the market's weak price action. The outflows have clearly weighed on both price and sentiment, helping to drive historically bad year-to-date performances for Bitcoin and Ethereum. Both assets are down nearly 24% from the start of the year, marking their worst openings on record. The sheer volume of supply held by these large players creates a persistent headwind, capping rallies and contributing to the range-bound trading between $67,000 and $70,000 for Bitcoin.

The pressure is compounded by other factors, but whale distribution remains the dominant structural headwind. While ETFs have seen outflows and leverage has compressed, the net effect of $30 billion in whale outflows is a sustained supply overhang. Until this dynamic reverses, the path of least resistance for prices appears to be consolidation within the current range.

Catalysts and Risks: Security Incidents vs. Macro Flows

The market's recent bounce is a classic headline-driven move. Bitcoin's 5% climb to $66,843 over the weekend followed the easing of Iran strike threats, with traders interpreting the death of Iran's Supreme Leader as a potential catalyst for a shorter conflict. Yet the rally is built on thin liquidity, making it inherently fragile. The same weekend volatility that saw prices swing from below $64,000 to above $66,000 also highlights how quickly optimism can reverse.

The real test for this bounce arrives with the reopening of traditional markets. Upcoming moves in oil, equities, and bonds are the key macro catalysts that will determine if crypto's optimism holds. If these markets react negatively to geopolitical developments or economic data, the weekend's gains could be quickly faded. The market's path will be dictated by institutional capital flowing in from these broader asset classes, not just speculative crypto traders.

At the same time, a persistent security risk looms. February 2026 saw $37.7 million in total crypto exploits, with wallet thefts alone causing $16.6 million in losses. This ongoing threat of malicious activity creates a constant undercurrent of risk that could trigger further outflows from exchanges, adding another layer of pressure on prices.