US Authorities and CrowdStrike Disrupt Long-Running Crypto Theft Malware

Federal law enforcement officials, working alongside cybersecurity firm CrowdStrike, have disrupted a global malware network responsible for stealing cryptocurrency from unsuspecting victims over nearly two decades. The Justice Department confirmed the takedown of the Sality botnet in a joint operation involving authorities from Bulgaria, Hungary and Romania, along with private cybersecurity partners CrowdStrike and the Shadowserver Foundation.

Officials say the malware has been infecting devices since 2003, enabling both cyberattacks and crypto theft over the years.

How the Malware Stole Crypto Payments

CrowdStrike revealed that over the past eight years, operators behind Sality used a clipboard-hijacking tool called EggJagger to silently swap copied cryptocurrency wallet addresses with ones controlled by the attackers.

This meant that whenever a victim attempted to send Bitcoin or Ethereum, the funds were secretly rerouted to the criminals instead. The scheme resulted in roughly $150,000 worth of stolen crypto, with unspent holdings once valued at approximately $1.5 million.

The botnet had infected close to 15,000 computers worldwide, which regularly checked in with a peer to peer network. Following the coordinated crackdown, authorities say the operators have lost their ability to control the infected machines.