The U.S. Department of Justice has shut down the LummaC2 malware infrastructure, which had stolen crypto assets wallet mnemonic phrases.

On May 22, Decrypt reported that law enforcement has successfully seized the critical infrastructure of LummaC2, a malware that has committed mnemonic theft of cryptocurrency wallets against millions of users. The operation was jointly carried out by the U.S. Department of Justice, Europol, Japan’s Cybercrime Control Center, Microsoft and others.

According to Microsoft, more than 394,000 Windows systems worldwide were found to be infected with the malware between March and May 2025. Microsoft has seized and disabled more than 2,300 domains that support LummaC2’s operations through a civil lawsuit. The FBI confirmed that at least 1.7 million theft attempts occurred through LummaC2 alone.

Launched in 2022 by a Russian developer with the screen name “Shamel,” the malware is primarily marketed via Telegram and Russian-language forums, offering tiered service packages that allow buyers to customize, distribute, and track the stolen data.