U.S. federal law enforcement says it has helped disrupt a long-running cybercrime operation tied to cryptocurrency theft, working alongside international partners and private-sector cybersecurity experts. The Justice Department announced that the Sality malware and its botnet infrastructure were targeted in an effort spanning multiple countries.

According to the U.S. Justice Department, the operation involved Bulgarian, Hungarian and Romanian authorities, as well as partners including CrowdStrike and the Shadowserver Foundation. The department said Sality was used to compromise devices and facilitate theft of digital assets, with activity traced back to 2003.

Key takeaways

• The U.S. Justice Department said it disrupted the Sality botnet and associated malware in an international takedown effort.
• CrowdStrike linked the scheme to clipjacking behavior that targets cryptocurrency wallet addresses copied to a clipboard.
• U.S. officials and CrowdStrike described a peer-to-peer botnet of roughly 15,000 infected computers checking connectivity every 40 minutes.
• CrowdStrike reported at least 12.1 million rubles (about $150,000) stolen over an eight-year period tied to “never-spent” digital assets, with a peak value around January 2025.

What the Justice Department says was targeted

In a Tuesday notice, the U.S. Justice Department stated that it had “disrupted the Sality botnet and malware” through a coordinated international operation. The department’s announcement names government agencies in Bulgaria, Hungary and Romania, while also citing private-sector support from CrowdStrike and the Shadowserver Foundation.

Officials said Sality malware was responsible for installing malicious code on compromised systems. They tied that activity to both cryptocurrency theft and broader cyberattacks. While the announcement frames the action as a disruption rather than a total elimination, the message is clear: the takedown interfered with the malware’s ability to coordinate with infected machines.

The announcement also underscores why botnets remain a key threat vector for the crypto sector. Malware operators can use compromised endpoints to manipulate users and move stolen assets, turning ordinary wallet operations—like copy-and-paste—into moments of vulnerability.

The clipjacking mechanism behind the crypto theft

CrowdStrike provided technical detail on how actors behind Sality allegedly harvested cryptocurrency payments. In a post describing the operation, the company said the criminals used EggJagger, described as a “clipjacking tool” that monitors a device’s clipboard for cryptocurrency wallet addresses.

The method is designed to be difficult for victims to notice. When a user copies a Bitcoin or Ethereum address to send funds, CrowdStrike said the malware can silently replace that address with one controlled by the attacker. In its explanation, CrowdStrike said that “funds are redirected” when the victim pastes the altered destination address into a payment.

This matters for investors and users because it highlights a persistent class of wallet-related risk: attacks do not always require users to install obviously malicious software. Instead, they can compromise normal device behavior and quietly reroute transactions.

Scale and operational details described by CrowdStrike

CrowdStrike said that in the eight years preceding the disruption, the operators behind Sality used EggJagger to steal at least 12.1 million rubles—about $150,000 in cryptocurrency—by redirecting copied wallet addresses. The company also reported that the value of the “never-spent” digital assets peaked at about $1.5 million in January 2025.

Officials and CrowdStrike described a network architecture built around peer-to-peer communication. In their account, around 15,000 infected computers formed a botnet that would check whether systems were online every 40 minutes. The operational cadence is notable: such periodic communication patterns often help attackers maintain control while keeping command-and-control traffic manageable.

As a result of the authorities’ efforts, CrowdStrike and U.S. officials said the criminals “lost the ability to communicate with infected machines.” That shift is a practical outcome of takedowns: even if some malware remains on endpoints, the attacker’s capacity to coordinate, update tactics, or manage automated theft can be severely reduced.

Why this takedown is significant for crypto security

Criminal ecosystems built around clipboard manipulation reflect a larger reality for the cryptocurrency space: user behavior and device integrity are often the weakest links. The Sality/EggJagger case demonstrates that even basic actions—copying addresses—can become an attack surface when malware is present.

For defenders, the episode reinforces the importance of hardening endpoints and monitoring for suspicious clipboard activity, not just traditional signs of malware infection. For crypto users, it strengthens the case for safer transfer practices such as verifying addresses through trusted channels and being cautious when transactions are prepared on potentially compromised systems.

From a broader market perspective, disruptions like this can reduce the flow of stolen assets—though the exact immediate impact is hard to quantify from public reporting alone. What is clear from the announcements is that law enforcement and security researchers were able to interfere with a mature cybercrime setup that had been active for years.

Looking ahead, readers should watch for two things: whether additional reporting clarifies how many victims were impacted in total, and whether security teams publish indicators or mitigation guidance connected to Sality and EggJagger techniques. As the ability to communicate with infected machines has been disrupted, the more enduring question is how quickly attackers will attempt to reconstitute similar clipboard-stealing capabilities elsewhere.

New Jersey has asked the U.S. Supreme Court to decide whether federal derivatives law prevents states from regulating sports contracts offered by CFTC-registered prediction markets.

A Sept. 2 court filing shows that New Jersey has petitioned the Supreme Court for a writ of certiorari, asking the justices to review a Third U.S. Circuit Court of Appeals decision that favored Kalshi.

The petition asks whether the Dodd-Frank Wall Street Reform and Consumer Protection Act prevents states from applying their sports-gambling laws to bets made within their borders when the contracts are offered on a market registered with the Commodity Futures Trading Commission.

Kalshi operates a designated contract market overseen by the CFTC. The company treats its sports products as event contracts governed by federal derivatives rules, while New Jersey considers them sports wagers subject to state licensing and consumer-protection requirements.

New Jersey challenges Kalshi’s Third Circuit victory

In April, the Third Circuit upheld preliminary relief that stopped New Jersey regulators from enforcing state gambling laws against Kalshi’s sports contracts.

The appellate court found that Kalshi had shown a reasonable chance of succeeding on its claim that sports event contracts qualify as swaps under the Commodity Exchange Act. Under that interpretation, the CFTC’s exclusive jurisdiction could displace conflicting state requirements.

As crypto.news reported at the time, the decision did not settle the full lawsuit. It affirmed a preliminary injunction, meaning the court assessed Kalshi’s likelihood of success without issuing a final judgment on every part of the dispute.

New Jersey is now asking the Supreme Court to reject the appellate court’s interpretation. According to the petition, Congress did not clearly authorize federally registered markets to offer sports betting across the country without complying with state gambling laws.

State officials also argue that sports wagering has long fallen under state authority. Under New Jersey’s position, registering an exchange with the CFTC does not automatically turn a sports bet into a federally protected financial contract.

The petition challenges the Third Circuit’s treatment of sports event contracts as swaps, a classification central to Kalshi’s federal preemption argument. If the products do not fall within that category, the state contends that the Commodity Exchange Act’s exclusive-jurisdiction provision cannot shield them from local enforcement.

Conflicting Kalshi rulings strengthen the request for review

New Jersey’s filing points to a conflicting decision from the Ninth U.S. Circuit Court of Appeals, which recently allowed Nevada to enforce its gaming laws against prediction market sports contracts.

In the Nevada dispute, the Ninth Circuit found that sports contracts were likely wagers rather than swaps covered by the Commodity Exchange Act. The court rejected the argument that CFTC oversight automatically prevented state regulators from acting.

The Ninth Circuit ruling produced a direct disagreement between two federal appellate courts. Kalshi has protection from New Jersey enforcement under the Third Circuit’s reasoning, while prediction market operators face state gambling controls within the Ninth Circuit.

A split between appellate courts is one factor the Supreme Court considers when deciding whether to hear a case, although the filing does not mean the justices have accepted New Jersey’s petition. Kalshi will have an opportunity to respond before the court decides whether to grant review.

The state cited the Ninth Circuit decision in its petition, arguing that the opposing rulings have created uncertainty over the line between federal derivatives oversight and state gambling regulation.

Similar disputes have already spread to other jurisdictions. In August, a federal judge rejected Coinbase’s request to block Michigan regulators from taking action against sports prediction markets, while New York has separately sued Kalshi over products that state officials describe as unlicensed gambling.

New York’s complaint seeks at least $36 billion in penalties and restitution. The state has accused Kalshi of offering unlicensed wagering products and allowing access without the safeguards required of licensed sportsbooks, allegations that Kalshi disputes.

By mid-August, the state enforcement fight had produced more than 20 lawsuits and cease-and-desist actions across the United States. Arizona had also filed criminal charges, while several other states had ordered prediction market operators to stop offering sports-related products.

Major-questions doctrine enters the Kalshi case

Sports law attorney Daniel Wallach said New Jersey’s petition invokes the major-questions doctrine, which courts use when an agency claims authority over an issue carrying major economic or political consequences without clear direction from Congress.

Quoting earlier Supreme Court language, the state called the Third Circuit’s interpretation an “astonishing” conclusion with grave “economic and political consequences.”

New Jersey also argued that allowing federal derivatives law to displace state sports-gambling rules would represent a “significant change in the sensitive relation between federal and state” power in an area of “traditional state authority.”

Under the state’s argument, Congress would have needed to speak clearly before allowing the CFTC’s authority to override local sports-betting laws. The petition says Dodd-Frank contains no clear statement giving federally registered exchanges nationwide immunity from state gambling controls.

Kalshi offered a different reading in a statement shared with Front Office Sports. The company said the Ninth Circuit still accepted the central principle that the CFTC’s exclusive jurisdiction can preempt state law, while disagreeing over how an existing regulation applies to sports contracts.

According to Kalshi, the regulation behind that disagreement is already being rewritten.

“We remain confident in the lower courts’ rulings, and nothing in New Jersey’s filing today changes our view,” the company said.

The CFTC has proposed changes to its event-contract rules, but any final regulation could face a separate court challenge over the agency’s legal authority or rulemaking process. The Ninth Circuit decision could also give states another basis for contesting a rule that treats sports contracts as federally governed derivatives.

Prediction market valuations continue to climb

While legal challenges have spread across the United States, private investors have continued assigning multibillion-dollar valuations to the largest prediction market platforms.

An Aug. 25 SEC filing showed that Kalshi had sold approximately $1.12 billion in equity since April, with about $380 million left under an offering of nearly $1.5 billion. The filing did not identify which financing rounds were included in the amount already sold.

Kalshi’s recent equity filing may include its $1 billion Series F round, which valued the company at $22 billion. Coatue led that financing with participation from Sequoia Capital, Andreessen Horowitz, IVP, Paradigm, Morgan Stanley, and ARK Invest.

Company figures released around the Series F placed Kalshi’s annualized trading volume at $178 billion, up from $52 billion over six months. Kalshi also reported more than two million monthly users and about $1.5 billion in annualized revenue at the time.

Sports accounted for an estimated 85% to 90% of Kalshi’s trading volume, according to figures discussed during a May prediction market debate at Consensus Miami. The concentration makes the classification of sports contracts material to the company’s U.S. operations.

Rival Polymarket is also seeking new funding. A reported $1 billion round would value the company at approximately $21 billion, with Donald Trump Jr.-linked 1789 Capital planning to invest about $300 million.

Polymarket’s U.S. business operates through QCX LLC, a CFTC-designated contract market acquired by the company. Intercontinental Exchange, the owner of the New York Stock Exchange, remained Polymarket’s largest investor after accumulating an approximately 22% stake, according to the Wall Street Journal.

For many long-term XRP holders, waiting for market prices to rise has been a common strategy, however, the cryptocurrency market is highly volatile, and relying solely on price fluctuations for profit means facing market uncertainty.

With the continuous development of automation and intelligent systems, more and more digital asset users are focusing on more convenient ways to use their assets. XRPPower is now launching a limited-time participation program for eligible XRP users, allowing them to learn about and experience the platform’s automated trading system, exploring long-term daily profit opportunities while reducing complex manual operations.

This program aims to provide long-term XRP holders with more digital asset service options. Through automated systems and pre-set operating mechanisms, users can participate in related services without frequently monitoring market changes or engaging in lengthy manual operations.

How can new users join XRPPower and learn about its services?

1. Free account registration

You can quickly create an XRPPower account using your frequently used email address; the registration process is simple and convenient. After registration, you can access the platform to learn about related functions, services, and different plans.

2. Understanding platform services and plans

Based on your individual needs, view the duration, participation conditions, and related rules of different service plans. Before participating, it is recommended to fully understand the service content and potential risks.

3. Participate using supported digital assets

Depending on the payment methods provided by the platform, users can use supported digital assets such as XRP, BTC, ETH, and USDT to participate in related services. Please confirm the specific conditions and rules before proceeding.

4. View account information and service records

Users can view relevant service records, balance changes, and historical information through their accounts at any time for a clearer understanding of their account status.

Based on individual needs and platform rules, users can apply for withdrawals or continue to explore other service options offered by the platform.

Some popular profitable contracts

Investment Amount: $1000, Investment Period: 7 days, Daily Yield: $13.2, Principal Returned at Maturity: $1000

Investment Amount: $5000, Investment Period: 15 days, Daily Yield: $70.5, Principal Returned at Maturity: $5000

Investment Amount: $10000, Investment Period: 20 days, Daily Yield: $153, Principal Returned at Maturity: $10000

Click to view all contract yields

How to achieve long-term returns with zero investment

New users receive a $21 bonus upon registration, which can be used to purchase daily contracts, earning $0.60 per day.

Additional referral rewards

Log in to your account using your referral code or request link to invite friends and family to join the XRPPower platform and earn permanent rewards of 3% + 2%.

Example description:

(A) User A refers User B to make an additional investment; if B invests $10,000, A will receive a 3% ($300) reward.

(B) User B refers User C to make an additional investment; if C invests $10,000, B will receive a 3% ($300) reward, while A will receive a 2% ($200) second-level referral reward.

XRPPower Intelligent Technology System: Continuously enhancing security, efficiency, and transparency

In today’s ever-evolving digital service landscape, users are increasingly focused on platform security, system stability, operational efficiency, and information transparency. XRPPower continuously improves its technical architecture and service processes around these core areas, providing users with a clearer and more convenient digital service experience.

Strengthening security architecture and enhancing multi-Layer protection

XRPPower strengthens platform security through various technical measures, including SSL/TLS encryption, two-factor authentication (2FA), cold and hot wallet isolation, multi-signature, and access control management.

Simultaneously, the platform continuously monitors the relevant practices of international professional institutions in risk management, internal control, and information security, and references the professional concepts of international professional auditing and consulting firms such as PwC to continuously optimize internal management and security processes.

Intelligent monitoring for more efficient system operation

XRPPower applies intelligent data analysis and automation technologies to daily system operations, monitoring system status and abnormal activity to help improve risk identification and operational efficiency.

Furthermore, the platform combines DDoS protection, Web Application Firewall (WAF), and other network security technologies to continuously strengthen network and infrastructure protection capabilities.

Making service information clearer and more understandable

To help users better understand the platform, XRPPower continuously optimizes service pages and account functions, providing a clearer display of service rules, participation conditions, cycles, and related information.

Users can view relevant records and information through their accounts and independently understand and select relevant services according to their needs.

Continuous innovation, driving technology and service upgrades

As artificial intelligence and digital infrastructure technologies continue to develop, XRPPower will continue to monitor industry changes and improve its overall service capabilities through technology updates, system optimization, and process refinement.

In the future, the platform will continue to focus on security, stability, transparency, and intelligence, continuously improving its digital service system to provide users with a more convenient and efficient service experience.

Learn more: https://xrppower.com/

Email: [email protected]

Bitcoin (BTC) sold off into the early European trading hours on Wednesday to hit local lows of $76,400, per data from CoinGecko.

Key points: 

• Bitcoin’s apparent demand indicator turns negative again, with BTC price dropping to a local low of $76,400 before reclaiming $77,000.
• USD/JPY drops sharply to 158.5, sparking speculation that another yen intervention has taken place.
• Asian equities sell off sharply as South Korea’s KOSPI falls 4.0% to 6,562.72 and Japan’s Nikkei 225 drops 2.9% to 64,325.64.

Bitcoin’s apparent demand flips negative again

The move in BTC came after US spot Bitcoin exchange-traded funds (ETFs) recorded outflows of $236 million the day prior. Data from CryptoQuant now shows Bitcoin’s apparent demand turning negative once more after a brief reprieve during the August rally. 

Bitcoin price and apparent demand, 30-day change. Source: CryptoQuant

The indicator is inspired by similar metrics from commodity markets and measures the difference between newly mined issuance and changes in inactive supply. Positive demand implies that old coins are waking up and the market is absorbing them along with new issuance. This is taken to be a sign of active spot demand. Negative readings mean coins are aging into dormancy faster than miners issue them. 

At the time of writing, BTC has reclaimed $77,000, but remains pinned under a cluster of resistance that we have previously reported on. 

Bonds and Asian equities sell off

The global bond rout that Cointelegraph reported on Monday eased slightly as the US 10-year yield briefly dipped below 4.8%. There was inorganic price action in the USD/JPY pair at 13:00 UTC, which commentators widely took as a sign of another central bank intervention. USD/JPY declined to 158.5, retreating from the psychological 160 level widely seen as a line the Bank of Japan (BOJ) will defend. At the time of writing, no official announcement on the matter has been made. 

USD/JPY trading pair one-day chart. Source: TradingView

Asian equities, meanwhile, suffered steep declines, likely driven by soaring oil prices and further profit-taking in the AI sector. South Korea’s KOSPI led the decline, falling 4.0% to close at 6,562.72 as chipmakers SK Hynix and Samsung Electronics shed 4% and 4.7%, respectively.

Related: Bitcoin lows pierce $63K as Asia chip-stock crash spreads to Wall Street

Japan’s Nikkei 225 fell 2.9% to 64,325.64, dragged down by tech heavyweights including SoftBank Group, an OpenAI investor. Taiwan’s TAIEX rounded out the losses with a 1.7% drop. Back in July, Cointelegraph reported on the first cracks beginning to show on the US side of the AI trade, as credit spreads on hyperscalers rose significantly.