Sality Botnet Takedown: The Malware That Swapped Bitcoin Addresses
For eight years, a piece of Windows malware did one boring thing on roughly 15,000 machines: it watched the clipboard. Whenever someone copied a string that looked like a bitcoin or Ethereum address, it quietly swapped in an address belonging to a criminal in Russia. The victim pasted, glanced at the field, hit send, and the coins went to a stranger. On August 31, 2026, CrowdStrike, the FBI, the U.S. Department of Justice, Europol, and police in Bulgaria, Hungary, and Romania cut that network off from its operator for good.
The botnet was called Sality. It had been running since 2003, which makes it older than Bitcoin itself. That longevity, and the specific way it stole coins, is why this story matters to anyone who holds sats.
What Sality Actually Was
Sality started life as a file infector. It attached itself to executable files on a machine and spread through USB drives, network shares, and file sharing. No phishing emails, no exploit kits, no ongoing effort from the operator. It just kept copying itself into programs that people already ran.
Over its two decades it evolved into a peer-to-peer botnet. Instead of phoning home to a central server that police could seize, infected machines talked directly to each other and passed along instructions. According to CrowdStrike's writeup of the operation, two independent versions of the network stayed active until the takedown, both run by the same actor.
Sality's only real job was to deliver other malware. Over the years that included spam bots, credential stealers, and DDoS tools. But since roughly 2018, its main cargo was a payload CrowdStrike calls EggJagger, a clipboard hijacker built to steal crypto.
How Clipboard Hijacking Steals Bitcoin
The attack is almost embarrassingly simple, which is exactly why it works.
A bitcoin address is a long string of characters that nobody memorizes. Standard practice is to copy it from a wallet, an invoice, or a message, then paste it into the send field of another wallet. EggJagger sat in the background and monitored the clipboard. When it saw a string matching the pattern of a bitcoin or Ethereum address, it replaced the clipboard contents with an address the attacker controlled.
Because the pasted string still looked like a valid address, and because most people check only the first few characters if they check at all, the swap went unnoticed. The transaction confirmed on-chain like any other. There was no hack of the wallet, no stolen seed phrase, no exploit of Bitcoin itself. The victim signed a perfectly valid transaction to the wrong person.
CrowdStrike estimates the operator stole at least 12.1 million rubles, roughly $150,000, through EggJagger alone. That sounds small until you consider the coins were never spent. The unspent stash peaked at about 147 million rubles, around $1.35 million, in January 2025. For one person running infrastructure that maintained itself, that is a comfortable living extracted one careless paste at a time.
How the Network Was Taken Down
The interesting part of the operation is that the same design choices that made Sality resilient made it impossible to fix.
Sality's peer-to-peer protocol could not be patched. Because it spread as a file infector, pushing a new version would have meant the new strain competing with the old one for the same host files. So the protocol behaved in 2026 exactly as it did in the mid-2000s, and every weakness was permanent.
The critical weakness: bots trusted any peer that answered the handshake correctly. No authentication, no cryptographic identity, no allowlist. So defenders joined the network as fake peers. Every 40 minutes, each infected machine checked whether its known peers were still online, rewarding responsive ones and purging dead ones. CrowdStrike manipulated that maintenance cycle to invalidate the real peers in each bot's list and insert sinkhole servers in their place. From the operator's view, the machines simply vanished. This is the same technique used against the GameOver Zeus botnet in 2014.
There is a lesson here that Bitcoiners will recognize. Sality survived for 23 years because it had no central server to seize. It fell because it had no way to verify who it was talking to. Bitcoin's peer-to-peer network survives for the opposite reason: every node validates every block and every transaction independently, so a malicious peer can waste your bandwidth but cannot feed you a fake chain. Decentralization without verification is just a slower way to lose.
Why This Attack Never Goes Away
Sality is gone, but clipboard hijacking is not. It is one of the cheapest crypto-theft techniques in existence, it requires no zero-day, and it works against people using perfectly good hardware wallets, because the swap happens before the address ever reaches the device.
Malware families like this show up constantly in cracked software, fake wallet downloads, browser extensions, and pirated games. The infected machine is usually a Windows PC that has been running the same bloated install for years. The victim usually has no idea anything is wrong until a payment goes missing, and by then there is nothing to reverse.
The One Habit That Beats It
Here is the practical takeaway, and it is not complicated.
- Verify the full address after pasting, not before. Compare the first six and last six characters of what you pasted against the source. Attackers sometimes generate vanity addresses that match the first few characters, so check both ends.
- Verify on the hardware wallet screen, not the computer. This is the entire point of a hardware wallet. The device shows you the destination address it is about to sign for. If it does not match the invoice, do not confirm. Malware on your PC cannot alter what the secure screen displays.
- Send a small test transaction for large amounts. Fees are a rounding error compared to losing a whole payment. Confirm the recipient received it, then send the rest.
- Use QR codes when you can. Scanning an address from a screen with a mobile wallet bypasses the desktop clipboard entirely.
- Keep a clean machine for bitcoin. Cracked software and random downloads are how Sality-class infections happen. If your bitcoin computer is also your pirated-games computer, you do not have a bitcoin computer.
None of this requires new tools. It requires slowing down for the ten seconds it takes to read a string of characters. The people who lost money to Sality were not stupid. They were fast. Bitcoin transactions are final, and finality is a feature until you are the one who pasted the wrong address.
The Bigger Picture
Every year brings a headline about billions lost to crypto hacks, and almost every one of those losses happens somewhere other than Bitcoin's protocol: bridges, smart contracts, exchanges, and, in this case, the clipboard of an unpatched Windows box. Bitcoin has never been hacked. The attack surface is the human and the machine they use to touch it. Self-custody hands you full control, which means it also hands you full responsibility for the ten seconds before you press send.
If you have read this far, you already take that responsibility seriously. BitCloset makes heavyweight apparel for people who chose to hold their own keys and read their own addresses. Verify, don't trust. It works for botnets too.