preferred on
Points of Focus
- Sality’s crypto-stealing payload redirected Bitcoin and Ether payments for eight years.
- CrowdStrike isolated more than 15,000 infected machines using peer-to-peer sinkholing.
- Authorities seized malicious infrastructure across the US and three European countries.
CrowdStrike and US authorities have disrupted the long-running Sality botnet, cutting off a malware operation that spent the past eight years stealing cryptocurrency by quietly replacing Bitcoin and Ethereum wallet addresses copied by victims.
The broader Sality infrastructure dates back to 2003, making it one of the longest-running botnets still active before the takedown. On Aug. 31, CrowdStrike worked with the US Department of Justice (DOJ), the Federal Bureau of Investigation, the Defense Criminal Investigative Service, and the Shadowserver Foundation to sever infected machines from the network. Authorities in Bulgaria, Hungary, and Romania participated, with support from Europol and Eurojust.
LATEST: 🚨 CrowdStrike and US federal authorities have dismantled "Sality," a botnet that hijacked clipboard data to swap copied crypto wallet addresses with attacker-owned ones for 8 years. pic.twitter.com/J6nhdz8hUS
— CoinMarketCap (@CoinMarketCap) September 2, 2026
Europol said more than 11 million unique IP addresses have been associated with Sality over its lifetime, while at its peak the operation could reportedly reach as many as 1 million compromised machines.
Malware silently swapped copied crypto addresses
Sality originally distributed several forms of malicious software, including credential stealers, spam tools, and software used for distributed denial-of-service attacks.
Its crypto focus intensified around 2018 through a payload CrowdStrike calls EggJagger.
The malware continuously monitored a victim’s clipboard. When it detected a copied Bitcoin or Ethereum wallet address, it replaced that address with one controlled by the attacker.
If the user pasted the address into a wallet without checking it again, the transaction went to the criminal instead.
CrowdStrike estimates EggJagger stole at least 12.1 million Russian rubles, roughly $150,000, during its eight-year operation. Some stolen crypto remained untouched, and, as asset prices increased, those holdings were worth as much as $1.35 million in early 2025.
The loss estimate only covers activity CrowdStrike could attribute to EggJagger and does not represent every criminal use of Sality over its two-decade lifespan.
CrowdStrike attacked Sality’s decentralized design
Taking down Sality was harder than seizing a normal command-and-control server because the botnet used a peer-to-peer architecture.
Compromised devices communicated directly with one another and periodically checked which peers were still active. That decentralized structure allowed Sality to survive repeated security efforts without depending on one central machine.
CrowdStrike turned that system against itself.
Researchers manipulated Sality’s peer-verification process to invalidate genuine super-peers and insert servers controlled by defenders. As infected machines refreshed their peer lists, they were gradually directed toward these “sinkholes” instead of the operator’s infrastructure.
CrowdStrike said the operation isolated more than 15,000 currently infected systems and stopped Sality from distributing new payloads. Authorities simultaneously seized domains and removed URLs hosting malware.
Sality shows an old crypto theft method still works
The attack itself was technically simple compared with many modern crypto exploits.
There was no smart-contract vulnerability, private-key cryptanalysis, or exchange breach. Sality relied on users trusting the address they had just copied.
That weakness remains relevant because cryptocurrency transactions are generally irreversible once confirmed.
The takedown removes one established distribution network, but not the technique behind it. Clipboard hijackers remain a common class of crypto malware.
For users, the defensive step is equally simple: Verify at least the beginning and end of a wallet address after pasting it, particularly when transferring large amounts.
Sality survived for more than two decades because its infrastructure was difficult to dismantle. Its last eight years show that even an uncomplicated attack can remain profitable when it targets one repetitive behavior crypto users perform every day.
Share
Most read articles
