Bitcoin
Sality Botnet Dismantled After Eight Years of Crypto Clipjacking
U.S. authorities and CrowdStrike have taken down Sality, a decades-old botnet that stole Bitcoin and Ethereum by swapping wallet addresses in victim clipboards.
CrowdStrike and U.S. law enforcement have dismantled the Sality botnet, ending an operation that targeted cryptocurrency users for eight years. While the botnet itself has existed since 2003, its operators had been hijacking Bitcoin and Ethereum transactions using a clipboard-monitoring payload internally codenamed EggJagger.
The malware operated via clipjacking, silently monitoring an infected computer's clipboard and replacing copied Bitcoin or Ethereum addresses with attacker-controlled destinations. Because users routinely copy and paste cryptographic addresses, the substitution went largely unnoticed without triggering alerts or pop-ups.
According to CrowdStrike, confirmed thefts through this specific payload reached at least 12.1 million rubles, or roughly $150,000. Unspent balances linked to Sality-associated wallets peaked at approximately 147 million rubles in early 2025. Sality long evaded disruption because it lacked central command servers, relying instead on peer-to-peer communication among infected machines and spreading automatically via shared executable files.
These two are not the same thing, and one does not produce the other. The left is how this single article reads, from its tone alone. The right is the site’s own call on the asset, from indicators and analysis. Press tone feeds no score and no signal: on the only corpus this site has measured, daily tone tracked the move that had already happened and showed no measurable link with what followed.
More on Bitcoin All pieces →
- Neutral Block Files for US National Trust Bank Charter to Consolidate Crypto Custody
- Neutral Tokenized Asset Holders Cross 3.5 Million as Institutional Inflows Rebound
- Neutral Iran Eases Currency Restrictions to Permit Cross-Border Crypto Settlements
- Neutral Block Seeks OCC Approval for Builders Bank & Trust to Manage Digital Assets
Rewritten from the headline, the teaser and the one-line summary the qualification step produced — that is all the material there is, and nothing is added to it. The source link is kept on file so any item can be checked, and is not published here.
