CrowdStrike said the Aug. 31 disruption of the Sality botnet severed the operator’s ability to deliver new malware, but cryptocurrency address-swapping malware already installed on infected devices remains active and can still redirect payments.

According to CrowdStrike, Sality had infected more than 33,000 machines globally. The security firm identified EggJagger as the primary payload delivered through the botnet. That malware monitors a victim’s clipboard for cryptocurrency wallet addresses and replaces them with addresses controlled by the operator, creating a risk that users send funds to the wrong destination without noticing.

The U.S. Justice Department announced a multinational operation on Sept. 1, 2026, after U.S. authorities seized Sality-linked domains and partners in Bulgaria, Hungary, and Romania took related action. The disruption changed communications among infected machines and isolated them from the operator, according to CrowdStrike, but it did not remove malware that was already installed.

That distinction is central to the remaining risk. Users with infected systems still need to remove the malware locally. CrowdStrike said the number of users who lost cryptocurrency has not been specified. The firm also described Sality as a file infector that spreads through executable files and network shares, widening potential exposure beyond direct crypto users.

CrowdStrike recommended that network operators review logs for UDP traffic to 188.166.101[.]148 as a potential sign of Sality infection. The Justice Department said the Shadowserver Foundation is working with internet service providers to identify infected systems and help notify affected users.

Why It Matters

The case underscores a persistent crypto security problem: wallet theft does not require a protocol exploit or exchange breach when endpoint malware can alter destination addresses before a transaction is sent. Even after a coordinated law-enforcement action, user risk can remain in place if infected devices are not cleaned.

It also highlights the operational link between cybersecurity enforcement and crypto payment safety. Disrupting botnet infrastructure can limit further spread, but the practical outcome for users depends on post-takedown detection, notification, and device remediation.