Copying a wallet address? Malware could change it: the Sality case

When we think about cryptocurrency security, we often imagine attacks on blockchains or exchanges. In reality, one of the most concrete threats may be much closer: on the computer from which we are making the transaction.

On September 1, 2026, the U.S. Department of Justice announced an international operation against Sality, a botnet that had been active for more than two decades. CrowdStrike, which participated in the operation, said that in recent years Sality also distributed EggJagger, malware capable of monitoring a computer’s clipboard and intercepting wallet addresses.

How the theft worked

The mechanism is as simple as it is dangerous. A user copies a Bitcoin or Ethereum address to make a payment. The malware recognizes that a crypto address is in the clipboard and replaces it with one controlled by the attacker. If the user pastes and confirms without checking again, the transaction is sent to the wrong recipient.

CrowdStrike reports that the Sality infrastructure distributed malicious payloads to more than 15,000 infected machines and estimates that EggJagger stole at least about $150,000 worth of cryptocurrency. The international operation isolated the malware’s peer-to-peer network and seized domains connected to the infrastructure.

Why this matters to every crypto user

A correctly signed blockchain transaction cannot distinguish between the address we intended to use and one we pasted by mistake. The network executes the instruction it receives. That means security depends not only on the strength of the blockchain, but also on the device, the software, and—above all—the user’s verification habits.

Four simple checks before sending crypto

• After pasting the address, always compare at least the first and last characters with the original address.

• For significant amounts, consider sending a small test transaction before transferring the full amount.

• Keep your operating system, browser, and security tools updated, and avoid software from untrusted sources.

• If you use a hardware wallet, verify the address and transaction details on the device display before final confirmation.

The Crypto Mentor view

Cryptocurrency security does not begin with the blockchain—it begins with the device and the habits of the person using it.

The lesson from the Sality case is not to be afraid of cryptocurrency. It is to understand that secure technology can still be used insecurely. A few seconds of checking before a transaction can prevent an irreversible mistake.

Sources: U.S. Department of Justice · CrowdStrike

For informational and educational purposes only. This is not financial or investment advice.