A botnet that quietly stole Bitcoin and Ethereum for nearly a decade is finally offline. CrowdStrike and the U.S. Department of Justice announced this week that they had isolated more than 15,000 infected machines across four countries, dismantling the Sality botnet after eight years of operation, according to Decrypt. The takedown involved coordinated action spanning law enforcement and private cybersecurity — a pairing that's become more common as crypto theft has grown in scale and sophistication.
What Sality Actually Did
Sality wasn't a smash-and-grab operation. It was persistent, stealthy malware that embedded itself in host machines and harvested credentials over long periods. Victims often had no idea their wallets or exchange login details were compromised until funds were already gone. That longevity — eight years — is the detail worth sitting with. It means people who considered themselves careful users were still exposed.
The lesson isn't new, but the enforcement outcome makes it worth revisiting: where you store Bitcoin matters enormously. Hot wallets connected to infected machines, browser-stored seed phrases, and reused passwords are the entry points malware like Sality exploits. Hardware wallets and air-gapped signing devices exist precisely to close those gaps.
A Choppy Market Backdrop
The Sality news lands on a complicated day for Bitcoin prices. BTC is trading near $76,756 — down roughly 1% since midnight — as U.S. military strikes on Iran sent oil above $93 a barrel and pushed Treasury yields toward 4.8%, according to CoinDesk. That's a straightforward risk-off move: when geopolitical tension spikes, traders trim exposure across assets.
What's notable is how Bitcoin has held up relative to other tokens. Solana, Ethereum, and XRP each fell roughly triple what Bitcoin did over the past 24 hours, per CoinDesk. That relative stability is consistent with a broader pattern from August, when U.S. spot Bitcoin ETFs had their best month of 2026 — BTC gained roughly 25% — while reducing year-to-date net outflows by 66%, according to Cointelegraph.
Corporate Treasuries Keep Buying
Away from the price noise, corporate accumulation continued. Adam Back invested another $8.8 million into Capital B, a French bitcoin treasury firm listed on Euronext Growth Paris, according to The Block. The company is now targeting a total of 3,521 BTC and plans to add 376 BTC from this latest raise alone.
Meanwhile, Japan-listed Remixpoint sold its entire holdings of Ethereum, Solana, XRP, and DOGE — booking a $736,000 net gain — and now holds Bitcoin as its sole cryptocurrency, with approximately 1,506 BTC worth around $115 million, per The Block. Two companies, two different geographies, same directional conviction.
What to Watch
- Custody hygiene: The Sality takedown is a practical reminder to audit how you store Bitcoin — hardware wallets, not browser extensions or hot software wallets on shared machines.
- Macro pressure: Oil above $90 and bond yields near 4.8% are headwinds for risk assets broadly. September has historically been Bitcoin's weakest calendar month.
- Institutional accumulation: Corporate treasury buying from firms like Capital B and Remixpoint represents steady demand that operates independently of short-term price swings.
The DOJ has not yet disclosed how much Bitcoin was recovered from Sality-linked wallets, and that figure will matter for understanding the full scope of the operation.
For anyone donating Bitcoin to charity, the Sality case is a useful prompt to confirm your own wallet security before making a transfer — clean custody protects both you and the organizations you support.