The PC launcher for Goddess of Victory: NIKKE was tampered with to spread malware that steals saved passwords and crypto wallets. Shift Up CEO Kim Hyung-tae apologised on November 4, and fixes are rolling out. Here's what happened, who's affected, and what to do now.
Published November 4, 2026. Developing story.
What happened
| Game | Goddess of Victory: NIKKE (Shift Up, published by Level Infinite) |
| Affected | The PC launcher only; mobile versions aren't reported as affected |
| How | Launcher script files on the official download servers were tampered with by a third party (a supply-chain attack) |
| When | Reports differ: files may have been changed from late September, with exposure from around October 23–24 |
| What it steals | Browser-saved passwords, NIKKE account info, crypto wallets (28 types reported), SSH keys and cloud logins |
| Status | Shift Up confirmed the tampering; fixes are available and the investigation continues |
Shift Up first said it had found "irregularities that indicate the script files of NIKKE's PC launcher may have been tampered with by a third party." On November 4, CEO Kim Hyung-tae apologised and said the company is working with publisher Level Infinite and "mobilizing all our resources to find a fundamental solution."
According to a write-up by security researcher MotherSphere, reported by Inven Global and Automaton, commands that download outside malware were hidden in four files on Level Infinite's official content servers. By November 3, three of the four had been replaced. Some reports say the malware only activated on some launches, so not every player who opened the launcher was necessarily infected.
We may earn a commission from links on this page.
What to do if you play NIKKE on PC
- Don't open the PC launcher until Shift Up or Level Infinite officially confirms the issue is fully fixed. Play on mobile in the meantime.
- Check for signs of infection: players report looking for a "k2f_chan" entry in the launcher's debug log, in the Launcher/intl_service folder. If you're not comfortable digging through files, run a full scan with your antivirus instead.
- Change your passwords, starting with email, banking and any accounts saved in your browser, from a different, clean device if you can.
- Turn on two-factor authentication everywhere, using an authenticator app rather than SMS.
- If you keep crypto on that PC, move it. Send it to a fresh wallet created on a clean device. A hardware wallet keeps keys offline so malware can't sign transactions.
- Clear the launcher cache before running it again once the fix is confirmed.
Why this one is scary
Most malware comes from shady downloads. This came through an official game launcher, from the publisher's own servers, so even careful players who did everything right could have been hit. It's the same lesson as the Binance fake-job-interview hack: the computer you game on shouldn't be the one holding your crypto.
We'll update this article as Shift Up and Level Infinite share more. Want to know about every major hack this year? See our 2026 crypto hacks tracker.
Follow WIZY Blog on Reddit: r/HolyWizy
Sources
- Inven Global: Shift Up CEO Kim Hyung-tae apologizes for NIKKE PC launcher issue invenglobal.com
- Siliconera: NIKKE PC launcher tampered with by third party siliconera.com
- Automaton: NIKKE PC launcher reportedly compromised in supply-chain attack automaton-media.com
- The Asia Business Daily: NIKKE PC launcher hacking suspected, emergency update asiae.co.kr
- VGTimes: NIKKE PC launcher compromised to distribute malware vgtimes.com
Written by the WIZY creator
A lifelong gamer and Warhammer painter from Calgary, Canada, and the maker of the Crusade Journal and the WIZY RPG game. I write about games, hardware, Warhammer and crypto in plain English, and I check every fact against its source.
