Global Crackdown Freezes Millions in Stolen Crypto Assets
A sweeping international law enforcement operation targeting “cybercrime-as-a-service” malware has successfully frozen tens of millions of dollars in cryptocurrency stolen from unsuspecting victims.
In the latest phase of “Operation Endgame,” authorities identified, flagged, and seized over €41 million (approximately $47 million) in illicit crypto assets, Europol announced Wednesday. The two-week, multi-national effort dismantled the underlying infrastructure of three prominent malware families: SocGholish, Amadey, and StealC.
All three malware strains are designed to target cryptocurrency users. StealC, an infostealer marketed as a service since 2023, is adept at extracting passwords, browser cookies, and cryptocurrency wallet data from compromised computers. Researchers at Proofpoint noted that its control panel even featured a plugin specifically designed to attempt decryption of seed phrases for victims’ MetaMask wallets.
Amadey typically serves as the initial entry point, facilitating the deployment of additional malware. SocGholish, meanwhile, has been linked to the Russian cybercriminal group Evil Corp and often infects users through deceptive browser-update notifications displayed on compromised websites. Collectively, these malware families act as the initial stage of attacks that ultimately lead to drained crypto wallets, unauthorized account takeovers, and ransomware deployments.
Law enforcement agencies successfully took down 326 servers and 142 domains. They also recovered nearly 27 million stolen credentials from over 385,000 compromised systems and remediated approximately 15,000 infected websites, many of which belonged to small businesses. Microsoft, a key partner in the operation, reported that Amadey and StealC had infected more than 140,000 computers globally in the first two weeks of May alone.
Infostealers have emerged as a primary vector for cryptocurrency theft, quietly exfiltrating wallet files, private keys, and seed phrases from victims’ devices. These malicious tools employ a variety of methods to target crypto users, including the distribution of fake AI tools, compromised Steam wallpapers, and pirated game modifications.
The scope of exposure is significant. An earlier iteration of Operation Endgame late last year uncovered login data for over 100,000 crypto wallets that had been stolen but not yet fully drained.
Separately, Microsoft’s Digital Crimes Unit filed a U.S. racketeering lawsuit that, for the first time, treated two distinct malware families as a single criminal conspiracy. Leveraging AI tools, including Copilot, for malware analysis, investigators discovered that Amadey and StealC, despite being developed by different criminal entities, operated on shared infrastructure. This allowed Microsoft to pursue charges against enablers of both operations under the RICO Act and disrupt more than 200 command-and-control servers. The unit has since identified over 18,000 victim computers and initiated measures to sever the attackers’ control.
Microsoft’s Digital Crimes Unit has dismantled five operations in the past nine months that facilitated “Cybercrime as a Service” (CaaS). The unit emphasized that disrupting cybercrime requires a coordinated approach, working with partners to dismantle the systems that enable these attacks.
While such takedowns rarely eliminate malware entirely, and operators often regroup – with StealC releasing a new version as recently as this month – Europol and its partners are currently directing victim alerts through services like Have I Been Pwned. This allows users to check if their credentials, and consequently the access to their digital wallets, may have already fallen into criminal hands.
