Sality botnet dismantled after eight years of crypto theft
Ethereum (ETH)
Editor:
Eugene Serbin
Tremplin.io reports that the Sality botnet has been dismantled following a coordinated operation by CrowdStrike and the US Department of Justice. Active since 2003, the network spent its last eight years stealing Bitcoin and Ethereum by replacing copied wallet addresses in infected computer clipboards. The malware, known as EggJagger, intercepted payments before they were sent, directing funds to the operator's wallets rather than modifying the blockchain itself.
CrowdStrike estimated that this specific crypto activity caused losses of at least 12.1 million rubles, or approximately $150,000. The operation isolated more than 15,000 machines globally by exploiting a weakness in Sality's peer-to-peer authentication, adding blockpoints to remove legitimate peers. Authorities including the FBI and police in Bulgaria, Hungary, and Romania seized domain names and infrastructure.
A wallet containing stolen assets was retained by investigators, valued at approximately 147 million rubles, or $1.35 million, in January 2025. The botnet previously targeted the Russian exchange AvanChangea with a denial-of-service attack in September 2023. Infected machines now transmit data to CrowdStrike test servers, though the malware remains active until manually removed. The network's decentralized architecture had previously allowed it to regenerate automatically via network shares and removable drives.
How the market reacted
Whalio's own Binance spot order flow for ETH, measured when this story was written up on 2 September 2026. Not the outlet's figures.
ETH is trading at $2,418.57 with a 1-hour buy ratio of 54.5%, indicating short-term buying pressure that contrasts with the 49.6% ratio seen over the past four hours. The 24-hour buy ratio sits at 48.6%, suggesting that over the longer term, selling has slightly outweighed buying. Volume delta shows a positive flow of $1,491,719 in the last hour, but this is reversed by a negative delta of $814,654 over four hours and a significant outflow of $18,896,159 over 24 hours. This means that while there is immediate buying interest, the broader trend over the day has been dominated by sellers. The cumulative volume delta for the 24-hour period closed at $14,950,213, indicating that net buying has occurred over the full day despite the recent negative delta. Spot volume reached $674,850,745 with nearly 2.5 million trades executed.
The latest daily buy ratio of 46.8% sits at the 16th percentile of the last 322 days, against a median of 49.5% - weaker buying than most days.
Was that an ordinary day?
The same Binance spot measurements for ETH, averaged over the days leading up to the story.
Over the preceding week, the average buy ratio was 48.7%, which is nearly identical to the current 24-hour reading of 48.6%, showing no significant shift in sentiment. Trading volume over the last day was 0.99 times the weekly average, indicating that activity levels are completely normal compared to recent history. The coin has seen a price change of -1.0% over eight days, with a total volume delta of -$192,245,508 for the period. Only two of the past seven days saw net buying, suggesting that the current market behavior is consistent with a generally bearish weekly trend. This day is ordinary in terms of volume and ratio, as the metrics align closely with the weekly averages rather than deviating significantly.