# US authorities collaborate with CrowdStrike to combat crypto theft malware $150K cryptocurrency theft network dismantled in international operation - **Source:** [Cointelegraph.com News](https://brifing.si/source/2e81e982-0137-4db0-8ac2-351f37085775) - **Published:** 2026-09-02 - **Topic:** [Finance](https://brifing.si/c/finance) - **Original article:** - **On Brifing:** https://brifing.si/s/f2e84587-73ec-4553-b871-87e2b32b1430 ## Sality botnet operations The US Department of Justice, in collaboration with authorities from Bulgaria, Hungary, and Romania, dismantled the Sality botnet and malware. Active since 2003, this network installed malicious software on compromised devices to conduct cryptocurrency theft and cyberattacks. Private sector partners like CrowdStrike and Shadowserver Foundation supported the operation. ## EggJagger tool deployment Groups behind Sality used a 'clipjacking' tool called EggJagger over the past eight years. This tool monitored cryptocurrency wallet addresses and silently replaced copied addresses with operator-controlled ones. Through this method, thieves stole at least 12.1 million rubles (approximately $150K) in crypto. The stolen digital assets' value peaked at $1.5 million in January 2025. ## Theft technique explained CrowdStrike revealed that when users copied Bitcoin or Ethereum addresses to make payments, funds were redirected. This method caused unsuspecting users to transfer money to thieves. The operation disrupted criminals' ability to communicate with infected machines. ## Botnet infrastructure The Sality botnet utilized a peer-to-peer network of approximately 15,000 infected computers. This system checked every 40 minutes whether machines were online. The takedown prevented both cryptocurrency theft and cyberattack activities. ## International cooperation The operation succeeded through international collaboration between the US and Bulgaria, Hungary, and Romania. Contributions from private sector actors like CrowdStrike were equally crucial. This cooperation reaffirmed the importance of public-private partnerships in combating cybercrime. ## Crypto security threats The Sality case highlights security threats facing cryptocurrency users. Techniques like clipjacking remind users to remain vigilant. Experts recommend double-checking addresses before crypto transactions. ## Protecting digital assets The fact that stolen digital assets were never spent demonstrates the operation's critical timing. According to CrowdStrike's report, these assets' value reached $1.5 million in January 2025. The operation prevented criminals from utilizing these funds. ## Cybersecurity lessons The Sality operation emphasized the importance of international cooperation and private sector contributions in cybersecurity. Takedown of a 20-year-old botnet shows combating such threats requires persistence. It's time for crypto users to enhance security measures. ## Sources covering this story - https://cointelegraph.com/news/us-officials-crowdstrike-malware-stealing-crypto?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._