Based Apparel website goes offline after malware attack targeting crypto wallets

Based Apparel, the merchandise store co-founded by FBI Director Kash Patel before he took office, has been pulled offline after security researchers discovered the site was serving malware designed to steal cryptocurrency wallet credentials from visitors.

The site went dark on May 22, 2026, roughly one day after reports surfaced on X flagging the compromise. The attack specifically targeted macOS users and was capable of siphoning data from more than 200 crypto wallet browser extensions.

How the attack worked

Visitors to Based Apparel were presented with what appeared to be a legitimate Cloudflare validation check. Instead of verifying the user was human, the prompt tricked visitors into executing malicious terminal commands on their machines.

Once inside, the malware went to work harvesting browser credentials, session tokens, and sensitive data. The payload was particularly focused on crypto wallet browser extensions, with more than 200 different extensions in its crosshairs. MetaMask users reportedly received warnings about malicious transactions connected to their activity on the site before it was taken offline.

The malicious payload was flagged by 27 different antivirus engines on VirusTotal.

The Kash Patel connection

Based Apparel was co-founded by Patel and Andrew Ollis before his appointment as FBI Director. This is the second security breach connected to Patel in a matter of months. Back in March 2026, an Iran-linked email hack targeted his communications.

The exact number of users affected by the Based Apparel compromise hasn’t been disclosed. No specific cryptocurrency tokens or protocols were directly implicated, and dollar figures on potential losses remain unknown.

What this means for investors

The more than 200 wallet extensions targeted in this attack represent a broad cross-section of the crypto ecosystem. If you use any browser-based wallet, this is a reminder to audit your extensions, verify site authenticity before entering credentials, and treat unexpected Cloudflare-style prompts with skepticism, especially ones asking you to run terminal commands.

Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.