US joins CrowdStrike in crackdown on crypto-stealing malware

US federal authorities have moved against a malware network linked to cryptocurrency theft, working alongside CrowdStrike and other private-sector partners in an international operation. The action targeted the Sality botnet, which officials said had been active for years and had been used to compromise devices and enable broader cyberattacks. The effort also involved law-enforcement agencies in Bulgaria, Hungary and Romania, plus the Shadowserver Foundation.

How the malware worked

Officials said the network relied on malware that could infect a victim’s device and interfere with cryptocurrency transactions. CrowdStrike said the group behind Sality had used a tool called EggJagger to watch a clipboard for wallet addresses and replace them with addresses controlled by the operators. That kind of manipulation can be difficult for users to spot if they copy and paste payment details quickly.

The Justice Department said the disruption was part of a wider international push rather than a purely domestic case. By coordinating with foreign authorities and security firms, investigators aimed to take down the infrastructure that allowed the malware to keep spreading. The announcement did not indicate that the underlying threat had vanished altogether, only that this particular operation had been disrupted.

What investigators say was stolen

US officials said Sality had been installing malware on compromised devices since 2003. Over the past eight years, the activity tied to the botnet and its related tools redirected about $150,000 in cryptocurrency, according to the announcement. That figure is modest by the standards of major crypto hacks, but it shows how small-scale theft can accumulate over long periods.

The case highlights how cybercriminals continue to exploit basic user behavior around digital assets, especially the copying of wallet addresses. It also underscores the role of security vendors in modern enforcement work, where private firms often provide threat intelligence and technical support that help authorities map malicious infrastructure. For crypto users, the episode is another reminder that wallet-address tampering remains a live risk.

Because cryptocurrency transfers are generally irreversible, even a brief malware infection can have lasting consequences. The Sality case suggests that threats do not always arrive as headline-grabbing exchange breaches; some work quietly in the background, intercepting routine transactions one by one. That makes endpoint security and careful transaction checks central defenses for anyone handling digital assets.

This article is not investment advice and recommends no asset, level or direction; a single session's move is not evidence of a trend. For background see Crypto, Altcoin, Bitcoin, and for terms the finance glossary.