Europol Freezes $47M in Crypto in Global Infostealer Malware Takedown

The Takedown

Europol announced the disruption of three infostealer malware families—SocGholish, Amadey, and StealC—that targeted cryptocurrency holders by stealing wallet credentials and passwords. The operation froze approximately €41 million in crypto assets, according to law enforcement reports. The malware typically spreads through phishing emails, malicious downloads, and compromised websites, infecting systems to harvest stored credentials and seed phrases.

Scope and Vulnerability

The three malware families collectively represent a significant vector for theft targeting retail crypto users who store credentials or recovery phrases locally or in browser extensions. SocGholish, Amadey, and StealC are among the most prevalent infostealers in circulation, according to threat intelligence reports. The seizure highlights how much stolen crypto can accumulate when credential-harvesting malware runs undetected across thousands of infected machines.

Implications for Users

The operation demonstrates that law enforcement agencies are escalating coordination against crypto-targeted cybercrime, though recovery of stolen funds remains difficult and slow. The takedown may degrade the operational capability of these three malware families temporarily, but infostealers as a category continue to evolve. Security researchers and wallet providers have emphasized that local key storage, weak password practices, and unpatched systems remain the primary attack surface for these threats.