Oanda+coinpass+compromised -

A pause. “How do you know it’s not a trap?”

The flash drive had been clean of malware. But it had contained one other thing she hadn’t noticed until now: a hidden partition, 2 MB in size. Inside, a single image file. A photo of herself, taken last week, walking past that same coffee shop. oanda+coinpass+compromised

But the message writer said “they’re going to kill me.” That wasn’t a threat from a hacker. That was a threat from someone inside the operation. A pause

She opened a fresh terminal and ran a WHOIS on the IP. Nothing remarkable. Then she cross-referenced it against known OANDA login IPs from her account’s security log. Three matches over the past two weeks. Each one preceded by a Coinpass login from a different IP—but the same ASN. Inside, a single image file

Someone had her session tokens. Not her passwords—her sessions . That meant a browser extension, a compromised Wi-Fi network, or physical access to a device she thought was clean.

Coinpass next. Login. Withdrawal addresses. A new whitelist entry dated 46 days ago: 0x3F9...aE7 . Labeled “Savings 2.” She’d never labeled anything “Savings 2.” She clicked through the edit history. IP address: 185.165.29.101 . Not her home. Not her VPN. A known residential proxy from Eastern Europe.