Salyty Botnet Cracks Down After 8 Years of Crypto Theft: $4.2 Million Losses Revealed

Salyty, a botnet that has been online since 2003, has been siphoning off Bitcoin and Ethereum payments for the past eight years, generating 12.1 million rubles—approximately $150 thousand—in revenue.

The 8‑Year Crypto Heist: Scope of the Operation

CrowdStrike and the Department of Justice launched a global takedown on September 1, 2026, targeting the 15 000‑plus bot network that leveraged the EggJagger clipboard hijacker. The operation, coordinated across the U.S., Bulgaria, Hungary, and Romania, isolated more than 15 000 infected machines.

Loss Valuation: From Rubles to Dollars

■Stolen Portfolio: 147 million rubles (≈ $1.35 million) at peak in January 2025

■Unspent Funds: Over $4 million in purchasing power today

■Operator’s Take: 12.1 million rubles, i.e., $150 thousand

Decentralized Resilience of Salyty

■Peer‑to‑Peer: No central server; direct machine‑to‑machine communication

■Self‑Regenerating: Propagates via executable attachments on network shares and removable drives

■Bot List Manipulation: CrowdStrike removed legitimate peers and inserted sinkholes

Global Takedown

■United States: Seized Salyty‑linked domains and control points

■Bulgaria, Hungary, Romania: Local police dismantled European domains

■Shadowserver Foundation: Notified victims in partnership with ISPs

How Stolen Coins Were Laundered

■Conversion Strategy: Operator used exchanges like AvanChange to cash out stolen assets

■DDoS Incident: September 2023 attack on AvanChange interpreted as a personal grievance

Future Risks and Protective Measures

■Persistent Malware: Infected machines remain active until manually removed

■Detection Rules: CrowdStrike released network indicators and defensive rules

■Legal Framework: FBI, DCI, and international law‑enforcement agencies eliminated the botnet’s infrastructure

Cem Talu: The Salyty takedown underscores how “invisible” cyber‑risk can translate into substantial economic damage. The $4 million loss over eight years poses a direct threat to market liquidity and investor confidence. Institutional players must incorporate such incidents into risk‑management frameworks and leverage ETF flows and on‑chain analytics to build early‑warning systems for future attacks.