Europol seizes $47M crypto tied to SocGholish, Amadey, StealC
Police froze $47 million in cryptocurrency stolen by three malware families (SocGholish, Amadey, StealC) after a global Europol-led takedown disrupted 100,000+ infected devices. This matters because i
Police in the U.S. and Europe have frozen $47 million in cryptocurrency stolen by three major malware families— SocGholish, Amadey, and StealC—after a
Read Full Story at Decrypt →Why This Matters
The takedown of these three malware families—SocGholish, Amadey, and StealC—marks a rare but critical win against the booming infostealer economy, where stolen cryptocurrency fuels a shadow ecosystem of hackers, darknet markets, and state-aligned cybercriminals. Beyond the immediate financial impact, the operation exposes the persistent vulnerabilities in global cybersecurity infrastructure, where even coordinated law enforcement efforts struggle to keep pace with the rapid evolution of malware-as-a-service models.
Background Context
Infostealers like SocGholish and StealC have surged in popularity over the past five years, evolving from simple credential-stealing tools to sophisticated frameworks that can exfiltrate cryptocurrency wallets, browser data, and even two-factor authentication codes. The Amadey botnet, meanwhile, has operated as a Swiss Army knife for cybercriminals, offering ransomware deployment and cryptojacking as add-ons. Europol’s intervention follows years of warnings from cybersecurity researchers about the unchecked growth of these malware families, which have thrived amid the anonymity of darknet forums and the rise of cryptocurrency’s untraceable transactions.
What Happens Next
While the freezing of $47 million in crypto is a significant blow to the cybercriminal underworld, the long-term effectiveness of the takedown remains uncertain. The malware’s modular design means infected devices may still harbor dormant payloads, while new variants could emerge under different aliases. Law enforcement will likely face pressure to replicate this success against other prolific infostealers, such as RedLine or Lumma Stealer, but sustaining such operations will require sustained funding and cross-border cooperation—a challenge given the decentralized nature of cybercrime.
Bigger Picture
This operation underscores the escalating arms race between cybercriminals and law enforcement, where the latter often plays catch-up due to the low barriers to entry in malware development and the high profitability of cryptocurrency theft. It also highlights the growing role of Europol and Interpol in bridging gaps between national cybersecurity agencies, a trend that may accelerate as ransomware and infostealers increasingly target critical infrastructure. Yet, the persistence of these malware families suggests that technological solutions alone—like improved endpoint security—will be
