SKN | U.S. Officials and CrowdStrike Disrupt Sality Malware Network Behind Crypto Theft

Key Takeaways

• U.S. authorities and CrowdStrike have disrupted the Sality botnet, a cybercrime network that has operated since 2003 and enabled cryptocurrency theft.
• The operation isolated more than 15,000 infected machines worldwide, while the malware’s EggJagger component stole at least $150,000 in Bitcoin and Ethereum over eight years.
• The takedown highlights the growing importance of cybersecurity infrastructure as digital-asset adoption expands and sophisticated investors face increasingly complex operational risks.

U.S. federal authorities and cybersecurity company CrowdStrike have coordinated an international operation to disrupt Sality, a Russian-linked malware network that has been active for more than two decades and was used to steal cryptocurrency. The action comes as cyber threats increasingly intersect with digital assets, making security, custody and transaction integrity important considerations for crypto markets alongside regulation and liquidity.

Sality Network Targeted Thousands of Devices

The Sality botnet operated as a peer-to-peer network, allowing compromised computers to communicate directly without relying on a single centralized command server. Investigators identified more than 15,000 infected machines worldwide and used a coordinated sinkhole operation to isolate those systems from the criminal infrastructure.

The operation involved the U.S. Department of Justice, FBI, Defense Criminal Investigative Service and international law-enforcement agencies in Europe. Authorities also seized Sality-linked domains in the United States, while CrowdStrike disrupted communications between infected devices and the network’s operator.

The scale of the infrastructure is significant even though the directly identified cryptocurrency theft was comparatively modest.

Clipboard Malware Redirected Bitcoin and Ethereum

For approximately eight years, Sality’s primary cryptocurrency-related payload, known as EggJagger, monitored victims’ computer clipboards for copied cryptocurrency wallet addresses. When users prepared to transfer Bitcoin or Ethereum, the malware could replace the legitimate destination address with one controlled by the attacker.

CrowdStrike estimates that EggJagger generated at least 12.1 million Russian rubles in cryptocurrency theft, equivalent to roughly $150,000 based on current conversion estimates. The associated cryptocurrency portfolio reportedly reached a peak value equivalent to about $1.8 million at one point, although that valuation does not represent confirmed realized theft.

The technique illustrates a persistent weakness in digital-asset transactions: blockchain transfers are generally irreversible once confirmed, meaning malware that intercepts a transaction before broadcasting can redirect funds without exploiting the underlying blockchain itself.

Cybersecurity Risk Extends Beyond Market Volatility

The Sality operation is particularly relevant as crypto markets become more institutionalized. Bitcoin was trading near $77,000 in early September, with a market capitalization of roughly $1.5 trillion, meaning even relatively small vulnerabilities in transaction infrastructure can have broader implications as the value held across digital wallets continues to increase.

CrowdStrike has also reported that digital-asset theft by North Korea-linked actors reached $2.02 billion in 2025, a 51% increase from the previous year. Those figures demonstrate that cryptocurrency theft is no longer confined to isolated retail scams but has become a significant component of organized cybercrime.

Strategic Outlook for Digital-Asset Security

The Sality disruption demonstrates that effective crypto security increasingly depends on cooperation between governments, cybersecurity companies, exchanges and infrastructure providers. As institutional participation grows, investors are likely to place greater emphasis on endpoint security, transaction verification, custody controls and real-time threat intelligence. The challenge will be maintaining those defenses as attackers adopt faster automation and increasingly sophisticated techniques targeting the broader digital-asset ecosystem.