The Malware That Hijacked Crypto Payments for 8 Years | CoinDesk Daily artwork

The Malware That Hijacked Crypto Payments for 8 Years | CoinDesk Daily

CoinDesk Podcast Network

September 3, 2026

The copy-paste hack that stole $150K. CrowdStrike and federal authorities dismantled Sality, a botnet that spent eight years swapping copied wallet addresses for the attacker's, so victims unknowingly sent crypto to a stranger.
Speakers: Jennifer Sanasie

Topics: Business News, News, Daily News

**Jennifer Sanasie** (0:00)
A botnet quietly hijacked crypto payments for eight years, and the CFTC asked for dismissal of CME's lawsuit over perpetual futures. This is CoinDesk Daily.
Want trusted crypto research? Check out The Stack, Grayscale's blog. Visit grayscale.com/thestack.
RealFi, a smarter stablecoin backed by real world assets. Join the testnet now at realfi.co. CrowdStrike and federal law enforcement have dismantled Sality a botnet that spent its last eight years hijacking crypto payments on infected computers. The trick was simple. Sality watched the copy and paste clipboard and swapped any Bitcoin or Ether addresses for the attackers. Victims hit send and paid a stranger with no warning and no undo. The attackers stole around $150,000 over eight years. Much of it sat untouched and later climbed in value to as much as $1.35 million as crypto prices rose. The CFTC has asked a federal judge to dismiss CME's lawsuit over its approval of crypto perpetual futures, calling the dispute much ado about nothing. The regulator argues CME has no standing because it can't point to any real financial loss. CME sued in June after the CFTC approved Cal she's perpetual Bitcoin contract as a futures product. And the Justice Department says it has seized more than $560,000 in cryptocurrency intended for Hamas, along with the domains and servers the group used to raise money and recruit. Investigators used human sources to trace rotating crypto addresses promoted through an encrypted group chat and a fundraising website. The wallets were allegedly controlled on behalf of Hamas' military wing. Get more updates on coindesk.com. Want trusted crypto research? Check out The Stack, Grayscale's blog. Visit grayscale.com/thestack.
RealFi, a smarter stablecoin backed by real world assets. Join the testnet now at realfi.co.

Thousands of transcripts fetched by people building searchable podcast archives

Feed this to your agent

Try it now — copy, paste, done:

curl -H "x-api-key: pt_demo" \
  https://spoken.md/transcripts/1000651996090

Works with Claude, ChatGPT, Cursor, and any agent that makes HTTP calls.

From $0.10 per transcript. No subscription. Credits never expire. Prices exclude VAT, added at checkout for EU customers. Not what you expected? Email us within 14 days with 20 or fewer credits used and we refund the pack in full.

Using your own key:

curl -H "x-api-key: YOUR_KEY" \
  https://spoken.md/transcripts/YOUR_EPISODE_ID