Law Enforcement Takes Down Notorious Sality Botnet That Pillaged Crypto for Nearly a Decade

CrowdStrike and the U.S. Department of Justice have successfully dismantled Sality, one of the most persistent botnets in recent history. The coordinated operation targeted over 15,000 compromised machines across four countries, dealing a significant blow to cybercriminals who've been systematically stealing bitcoin and ethereum for eight years.

The Scale of the Threat

Sality wasn't your run-of-the-mill malware operation. This botnet represented a sophisticated, long-running infrastructure designed specifically to harvest cryptocurrency from infected systems. By maintaining control over thousands of machines simultaneously, threat actors could mine digital assets, intercept crypto transactions, and drain wallets with alarming efficiency. The fact that this operation persisted for eight years speaks to how deeply embedded these networks can become in global internet infrastructure.

The takedown identified compromised machines in multiple jurisdictions, requiring unprecedented coordination between international law enforcement agencies and private sector cybersecurity firms. CrowdStrike's involvement proved critical—the firm's threat intelligence and forensic capabilities allowed investigators to map the botnet's command-and-control infrastructure and identify the scale of infections.

Why This Matters for Crypto Security

For the broader crypto community, this dismantling raises an uncomfortable reality: your computer might be a vector for theft. Botnet operators don't discriminate—they target everyday users, businesses, and even corporate infrastructure. Once infected, a machine becomes part of a larger hive, executing commands remotely without the owner's knowledge.

The bitcoin and ethereum theft methods employed by Sality operators included:

• •Direct wallet compromise: Stealing private keys and seed phrases
• •Mining hijacking: Using infected CPU and GPU resources to mine cryptocurrencies
• •Transaction interception: Redirecting funds mid-transaction
• •Credential harvesting: Capturing exchange login information

This operation demonstrates why basic cybersecurity hygiene remains non-negotiable for anyone holding digital assets. Whether you're running a trading operation or hodling long-term, endpoint security isn't optional—it's foundational.

The Takedown Operation

The four-country coordination represents a new standard in crypto-related law enforcement action. Rather than prosecuting individual users, authorities targeted the infrastructure enabling mass theft. By isolating command servers and systematically cleaning infected machines, investigators eliminated the botnet's ability to execute new attacks.

CrowdStrike worked alongside DOJ prosecutors to build the technical case, providing forensic evidence of the malware's operations. The takedown wasn't instantaneous—it required mapping the entire botnet topology, identifying all infected endpoints, and coordinating simultaneous disruption across borders.