CrowdStrike and U.S. authorities dismantle Russian botnet used to steal cryptocurrency

Traders Union
All News
Crypto
Dismantle Russian botnet

Malware stole crypto through the clipboard

When a user copied an address to send Bitcoin or Ethereum, EggJagger replaced it with an address controlled by the attacker. If the victim failed to verify the address after pasting it and confirmed the transaction, the cryptocurrency was sent to the attacker with no way to reverse the transfer.

According to CrowdStrike, the scheme's operators received at least 12.1 million rubles, or about $150,000 at the time of the transfers, over eight years. Much of the stolen cryptocurrency remained untouched, and its value had risen to approximately $1.35 million by early 2025 as the crypto market gained.

The amount is relatively small for a cyber operation that lasted several years, but the scheme did not require a sophisticated attack on a blockchain or crypto wallet itself. An infected computer and a user's failure to verify the recipient address were enough to steal the funds.

Users are advised to check at least the first and last characters of a wallet address after pasting it before confirming every transaction. This can reveal an address substitution before an irreversible cryptocurrency transfer is approved.

More than 15,000 infected computers isolated

Sality could not be dismantled simply by shutting down a central command-and-control server.

The botnet used a peer-to-peer architecture, with infected computers communicating directly and checking approximately every 40 minutes whether known peers were still available.

Sality also lacked additional authentication for nodes connecting to the network. CrowdStrike exploited this weakness by replacing the addresses of genuine botnet peers with addresses controlled by its servers, isolating more than 15,000 infected devices from the network.

The operation was carried out during a demonstration at CrowdStrike's Day Zero conference in Las Vegas with the participation of federal law enforcement. The U.S. Department of Justice said Sality's operators were linked to Russia.

The incident comes amid a series of major attacks on cryptocurrency infrastructure. Earlier, the Cronos blockchain, closely associated with Crypto.com, was completely halted following an exploit of Tectonic, the largest lending protocol in its ecosystem, with preliminary losses estimated at around $75 million.

Cronos has operated since 2021 and is used to provide lower-cost transactions across Crypto.com products, while CRO remains one of the ecosystem's key assets. The Tectonic attack highlighted another source of risk for digital asset holders—vulnerabilities within DeFi protocol infrastructure itself.

Earlier, we reported that wallets linked to North Korea's Lazarus Group moved around $30 million in digital assets through Hyperliquid. The transfers were identified by analysts at blockchain intelligence platform Arkham.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.