US authorities collaborate with CrowdStrike to combat crypto theft malware
$150K cryptocurrency theft network dismantled in international operation
1Sality botnet operations
The US Department of Justice, in collaboration with authorities from Bulgaria, Hungary, and Romania, dismantled the Sality botnet and malware. Active since 2003, this network installed malicious software on compromised devices to conduct cryptocurrency theft and cyberattacks. Private sector partners like CrowdStrike and Shadowserver Foundation supported the operation.
2EggJagger tool deployment
Groups behind Sality used a 'clipjacking' tool called EggJagger over the past eight years. This tool monitored cryptocurrency wallet addresses and silently replaced copied addresses with operator-controlled ones. Through this method, thieves stole at least 12.1 million rubles (approximately $150K) in crypto. The stolen digital assets' value peaked at $1.5 million in January 2025.
3Theft technique explained
CrowdStrike revealed that when users copied Bitcoin or Ethereum addresses to make payments, funds were redirected. This method caused unsuspecting users to transfer money to thieves. The operation disrupted criminals' ability to communicate with infected machines.
4Botnet infrastructure
The Sality botnet utilized a peer-to-peer network of approximately 15,000 infected computers. This system checked every 40 minutes whether machines were online. The takedown prevented both cryptocurrency theft and cyberattack activities.
5International cooperation
The operation succeeded through international collaboration between the US and Bulgaria, Hungary, and Romania. Contributions from private sector actors like CrowdStrike were equally crucial. This cooperation reaffirmed the importance of public-private partnerships in combating cybercrime.
6Crypto security threats
The Sality case highlights security threats facing cryptocurrency users. Techniques like clipjacking remind users to remain vigilant. Experts recommend double-checking addresses before crypto transactions.
7Protecting digital assets
The fact that stolen digital assets were never spent demonstrates the operation's critical timing. According to CrowdStrike's report, these assets' value reached $1.5 million in January 2025. The operation prevented criminals from utilizing these funds.
8Cybersecurity lessons
The Sality operation emphasized the importance of international cooperation and private sector contributions in cybersecurity. Takedown of a 20-year-old botnet shows combating such threats requires persistence. It's time for crypto users to enhance security measures.