U.S. federal agencies and cybersecurity firm CrowdStrike announced Tuesday that they have dismantled the Salium‑based Sality botnet, a Russian‑operated malware network that covertly hijacked cryptocurrency transactions for more than eight years. The joint effort, led by the Department of Justice and the FBI, isolated more than 15,000 infected machines across four countries, seized the botnet’s command‑and‑control servers and began the process of returning stolen Bitcoin and Ethereum to their rightful owners.
Scope and Modus Operandi of the Botnet
The Sality botnet, first identified more than two decades ago, evolved from a generic file‑infector to a sophisticated financial crime platform. According to reports, the malware monitored victims’ clipboard activity for copied cryptocurrency addresses and silently replaced them with addresses controlled by the attackers. Over an eight‑year span, the operation amassed a significant amount of Bitcoin and Ethereum, though precise figures have not been disclosed.
"The operation had infected more than 15,000 computers across four countries," the DOJ statement said, underscoring the global reach of the campaign.
While most outlets agree on the 15,000‑machine figure, there is some variance in the botnet’s age. Techzine Global and The Next Web described Sality as a 23‑year‑old network, whereas forth.news and WDEZ.com referred to it as a 20‑year‑old operation. All sources concur that the malware’s criminal phase began roughly in 2015, when it started targeting cryptocurrency transactions.
Coordinated International Takedown
The takedown was a coordinated effort involving law‑enforcement agencies in the United States, Europe and other jurisdictions. CrowdStrike provided technical expertise, identifying the botnet’s infrastructure and assisting in the isolation of compromised hosts. The Department of Justice, together with the FBI, executed legal orders to seize servers and disrupt the command‑and‑control network. The operation spanned four countries, though specific nations were not named in the publicly released statements.
U.S. officials emphasized that the collaboration demonstrates a growing capacity to combat cross‑border cybercrime, especially as illicit actors exploit the anonymity of digital assets. National Technology News highlighted that the takedown marks one of the most significant disruptions of a Russian‑based cybercrime operation in recent years.
Crypto Market Context
The recovery comes at a time when the cryptocurrency market is experiencing renewed momentum. Bitcoin entered what analysts have dubbed “Rektember,” posting its strongest August performance since 2017, while Ethereum has also posted gains. The timing of the seizure may bolster confidence among investors who have long expressed concerns over security vulnerabilities and the prevalence of ransomware and malware schemes.
For crypto‑native readers, the incident underscores the importance of using hardware wallets and verifying address entries, as clipboard hijacking remains a common vector for theft. Mainstream audiences are reminded that while blockchain transactions are immutable, the points of entry—such as personal computers—remain vulnerable to sophisticated malware.
Authorities have not disclosed the exact amount of cryptocurrency recovered, but officials indicated that the process of tracing and returning the assets is underway. The operation also serves as a warning to other illicit actors that international cooperation can lead to the dismantling of even the most entrenched cybercrime infrastructures.
As the investigation continues, law‑enforcement agencies are urging victims to report any suspicious activity related to the Sality botnet. The case highlights the evolving threat landscape in the digital age, where traditional criminal enterprises intersect with emerging financial technologies.
Market Snapshot
| Asset | Price | 24h | Market Cap |
|---|---|---|---|
 Bitcoin BTC | $76,786 | -1.28% | $1541.5B |
 Ethereum ETH | $2,385 | -2.24% | $290.9B |
 BNB BNB | $684 | -0.26% | $91.1B |
 XRP XRP | $1.32 | -2.99% | $83.0B |
 Solana SOL | $98.09 | -3.64% | $57.4B |
 Dogecoin DOGE | $0.0810 | -1.72% | $12.6B |
 Cardano ADA | $0.195 | -1.54% | $7.3B |
Live data: CoinGecko — 2026-09-02 13:22 UTC
