A massive international law enforcement operation has frozen more than ⁄41 million (around $47 million) in cryptocurrency tied to cybercrime, targeting the infrastructure behind three notorious malware families that have been draining crypto wallets worldwide.
Operation Endgame, led by Europol and spanning two weeks, dismantled SocGholish, Amadey, and StealC — three malware tools that work together to steal passwords, browser cookies, and crypto wallet data from infected computers. Police took down 326 servers and 142 domains, recovered roughly 27 million stolen credentials from over 385,000 compromised systems, and cleaned nearly 15,000 infected websites.
StealC, sold as a service since 2023, is particularly nasty. It scrapes wallet files and credentials from victims’ machines, and its control panel even included a plugin designed to decrypt MetaMask seed phrases. Amadey typically gains the initial foothold and drops additional payloads, while SocGholish — linked to the Russian group Evil Corp — infects people through fake browser-update prompts on hacked sites.
Microsoft, a partner in the operation, linked Amadey and StealC to over 140,000 infected computers worldwide in the first two weeks of May alone. The company’s Digital Crimes Unit filed a U.S. racketeering lawsuit treating both malware families as a single criminal conspiracy, using AI tools including Copilot to analyze the code and discover shared infrastructure.
Infostealers have become one of the primary ways crypto gets stolen. They target users through fake AI tools, Steam wallpapers, and pirated game mods. An earlier Operation Endgame action uncovered login data for over 100,000 crypto wallets that had been stolen but not yet emptied.
The takeaway? If you’re holding crypto in a hot wallet on a machine you also use for browsing or gaming, you’re in the crosshairs. Hardware wallets and dedicated devices for high-value accounts aren’t paranoia anymore ’ they’re common sense.
