CrowdStrike and U.S. authorities dismantle Russian malware botnet that secretly stole Bitcoin and Ethereum by replacing copied wallet addresses for eight years

CrowdStrike and U.S. federal law enforcement dismantled Sality, a botnet operating since 2003 whose final eight years targeted cryptocurrency payments. Its payload, dubbed "EggJagger," monitored clipboards on infected machines and swapped copied Bitcoin or Ethereum addresses with attacker-controlled ones, so victims unknowingly sent funds to criminals with no warning or recourse. CrowdStrike estimated the attackers stole at least 12.1 million rubles, roughly $150,000, over eight years. Much of the stolen crypto went unspent and appreciated to as much as $1.35 million by early 2025. The author notes users can verify an address's first and last characters after pasting.

✨ AI summary of the linked source — not editorial content.

Explore the topic

• Ethereum
• Wallet
• BTC
• Bitcoin