Home›Crypto›Market Structure›Authorities and CrowdStrike dismantle Sality botnet be…

Authorities and CrowdStrike dismantle Sality botnet behind crypto theft

The operation isolated more than 15,000 infected computers and attributed at least 12.1 million rubles, about $150,000, stolen over eight years.

Reported · Written up by our desk · Market Structure

U.S. cybersecurity firm CrowdStrike and federal law enforcement have dismantled Sality, a Russia-based botnet that hijacked cryptocurrency payments by tampering with copied wallet addresses, according to CoinDesk.

The malware, which operated without a central server, spread across network shares and USB drives and used a clipboard-watching payload to replace pasted Bitcoin or ether addresses with attacker-controlled ones, so victims effectively paid the wrong address after hitting send.

CrowdStrike said it exploited a security flaw to disconnect more than 15,000 infected computers. It also estimated the attackers stole at least 12.1 million rubles, about $150,000, over eight years.

The incident highlights a basic user defense, CrowdStrike said, by checking the first and last characters of an address after pasting it. CoinDesk reported that much of the stolen crypto was left unspent, with holdings later valued at as much as $1.35 million in early 2025 as crypto prices rose.

Latest closeBitcoin $77,563.82 ▲0.2%

More like this

Sources