The dismantling of Sality ends a long cryptocurrency hijacking operation. This botnet, active since 2003, spent its last eight years stealing bitcoins and Ethers. Its method relied on a simple technique: modifying wallet addresses copied on infected machines. CrowdStrike and the U.S. Department of Justice coordinated the operation. This globally conducted operation isolated more than 15,000 machines across several regions of the world. The crypto phenomenon was at the heart of this activity.