Someone had her session tokens. Not her passwords—her sessions . That meant a browser extension, a compromised Wi-Fi network, or physical access to a device she thought was clean.
The subject line was the only thing on the flash drive: oanda+coinpass+compromised . No file name, no folder. Just a single, nameless .txt file waiting inside. oanda+coinpass+compromised
She opened a fresh terminal and ran a WHOIS on the IP. Nothing remarkable. Then she cross-referenced it against known OANDA login IPs from her account’s security log. Three matches over the past two weeks. Each one preceded by a Coinpass login from a different IP—but the same ASN. Someone had her session tokens
The flash drive had been clean of malware. But it had contained one other thing she hadn’t noticed until now: a hidden partition, 2 MB in size. Inside, a single image file. A photo of herself, taken last week, walking past that same coffee shop. The subject line was the only thing on
They weren’t watching the platforms.
