{
  "story_id": "d17b1837ef94d5e501cb3eeb004e98a7",
  "desk": "drm3",
  "revision": 1,
  "published_at": "2026-09-03T22:40:00.000Z",
  "content_hash": "0acc9c42cc9ef9e98e3f4588b8a6c276ae6740662e49526c43235fdf6d761398",
  "hash_basis": "sha256 over `headline\\ndek\\nprose`, plus `\\n` + the canonical citations JSON when any source is placed, plus `\\n#blog` for blogs",
  "basis": {
    "headline": "US and European Authorities Dismantle Sality Bitcoin Botnet",
    "dek": "Justice Department and CrowdStrike disrupted Sality botnet after eight years of stealing cryptocurrency.",
    "prose": "The Justice Department and CrowdStrike announced on Tuesday that they had disrupted Sality, a peer-to-peer botnet that has been running since 2003. [^1]\n\nThe Federal Grand Jury in Los Angeles indicted Southworth on three counts of threatening to kill President Donald Trump and additional charges of cyberstalking and harassment against the president's personal lawyer and family. [^2]\n\nUS authorities arrested Benjamin Azariah Southworth, a 40-year-old resident of the Westlake neighborhood of Los Angeles, on September 3, 2026, for threatening to kill President Donald Trump. [^3]\n\nCrowdStrike estimates that the Sality operator stole at least $150,000 through its primary payload, EggJagger, over the past eight years. [^4]\n\nCrowdStrike values the unspent stolen cryptocurrency portfolio at a peak of about 147 million rubles in January 2025, which is roughly the purchasing power of $4 million in a Western capital. [^5]\n\nThe EggJagger payload monitors the clipboard for cryptocurrency wallet addresses and swaps them for the operator's own addresses, causing victims to send funds to strangers. [^6]\n\nFederal prosecutors accused Southworth of publishing the home addresses and phone numbers of the president's lawyer's family members, an act known as doxxing. [^7]\n\nProsecutors allege that Southworth used accounts on YouTube, Instagram, TikTok, and a personal website to publicly express hostility toward President Trump and his followers. [^8]",
    "cited": "[{\"statement\":\"The Justice Department and CrowdStrike announced on Tuesday that they had disrupted Sality, a peer-to-peer botnet that has been running since 2003.\",\"source\":\"Decrypt\",\"instrument\":\"News\",\"claim_key\":null,\"published_at\":\"2026-09-02T11:30:45.000Z\",\"publisher_count\":1,\"sources\":[\"Decrypt\"]},{\"statement\":\"The Federal Grand Jury in Los Angeles indicted Southworth on three counts of threatening to kill President Donald Trump and additional charges of cyberstalking and harassment against the president's personal lawyer and family.\",\"source\":\"El Tiempo\",\"instrument\":\"News\",\"claim_key\":null,\"published_at\":\"2026-09-03T22:40:00.000Z\",\"publisher_count\":1,\"sources\":[\"El Tiempo\"]},{\"statement\":\"US authorities arrested Benjamin Azariah Southworth, a 40-year-old resident of the Westlake neighborhood of Los Angeles, on September 3, 2026, for threatening to kill President Donald Trump.\",\"source\":\"El Tiempo\",\"instrument\":\"News\",\"claim_key\":null,\"published_at\":\"2026-09-03T22:40:00.000Z\",\"publisher_count\":1,\"sources\":[\"El Tiempo\"]},{\"statement\":\"CrowdStrike estimates that the Sality operator stole at least $150,000 through its primary payload, EggJagger, over the past eight years.\",\"source\":\"Decrypt\",\"instrument\":\"News\",\"claim_key\":null,\"published_at\":\"2026-09-02T11:30:45.000Z\",\"publisher_count\":1,\"sources\":[\"Decrypt\"]},{\"statement\":\"CrowdStrike values the unspent stolen cryptocurrency portfolio at a peak of about 147 million rubles in January 2025, which is roughly the purchasing power of $4 million in a Western capital.\",\"source\":\"Decrypt\",\"instrument\":\"News\",\"claim_key\":null,\"published_at\":\"2026-09-02T11:30:45.000Z\",\"publisher_count\":1,\"sources\":[\"Decrypt\"]},{\"statement\":\"The EggJagger payload monitors the clipboard for cryptocurrency wallet addresses and swaps them for the operator's own addresses, causing victims to send funds to strangers.\",\"source\":\"Decrypt\",\"instrument\":\"News\",\"claim_key\":null,\"published_at\":\"2026-09-02T11:30:45.000Z\",\"publisher_count\":1,\"sources\":[\"Decrypt\"]},{\"statement\":\"Federal prosecutors accused Southworth of publishing the home addresses and phone numbers of the president's lawyer's family members, an act known as doxxing.\",\"source\":\"El Tiempo\",\"instrument\":\"News\",\"claim_key\":null,\"published_at\":\"2026-09-03T22:40:00.000Z\",\"publisher_count\":1,\"sources\":[\"El Tiempo\"]},{\"statement\":\"Prosecutors allege that Southworth used accounts on YouTube, Instagram, TikTok, and a personal website to publicly express hostility toward President Trump and his followers.\",\"source\":\"El Tiempo\",\"instrument\":\"News\",\"claim_key\":null,\"published_at\":\"2026-09-03T22:40:00.000Z\",\"publisher_count\":1,\"sources\":[\"El Tiempo\"]}]",
    "kind": "news"
  },
  "receipt_verify": "Ed25519 over the dot-joined string `slice_hash.cursor_from.cursor_to.view.view_version.row_count`; public_key and sig are base64url of the raw 32-byte key / 64-byte signature",
  "receipt": null,
  "receipt_note": "this revision predates receipt-keeping (before v0.37.0); the filed row lives in the record",
  "generation_chain": {
    "wire": {
      "stream": "fountain_news",
      "story_id": "c7cfd0dde78d94ef6fd3ecdc97bad504",
      "thread_id": "f7cd6964a6b4dc46c368c0a6549ce040",
      "thread_label": "FBI Los Angeles",
      "novelty": "UPDATE",
      "content_hash": "ddcc38d0e8c59876121da81cb1e13162cf1d68d379ce1e16aaa38e96a20fe68c",
      "last_published_at": "2026-09-03T22:40:00.000Z",
      "read_receipt": {
        "slice_hash": "1422156713b8cd59725535e37e38ef77783f4374686d834438207c1942764f31",
        "cursor_from": "eyJ0cyI6IjIwMjYtMDktMDNUMjI6MjQ6MjQuMDAwMDAwWiIsImlkIjoiMmIwMjcwOGU1MDJhYjFjYWJhZmI3MzlmMTViZDc0MTQiLCJ2IjoiMSJ9",
        "cursor_to": "eyJ0cyI6IjIwMjYtMDktMDNUMjM6MDA6MDguMDAwMDAwWiIsImlkIjoiODhmZjU3M2MzYmNkZTQzMzc5ZTBlZmExMWQzZTc5OTciLCJ2IjoiMSJ9",
        "view": "v_fountain_news",
        "view_version": "1",
        "row_count": 100,
        "window_days": 3,
        "bytes_scanned": 12166856,
        "credits": 8,
        "price_per_100_rows": 8,
        "sig": "NGlp97IYsTU_yLWU3eUO9RAexi9nFDHg1wMDlTR6edydyzqFT-MNZE28iouGwqK-gvsE3qrw0HzaY3hsqe27Cg",
        "public_key": "bMUigy8O0jOnBxQ4Sc-5lwhIZ8LQVAhxMbR7qESVuUE",
        "signer_path": "lakehouse/data-extract/v1",
        "alg": "Ed25519",
        "signed": true
      }
    },
    "written_at": "2026-09-04T06:50:35.274Z"
  },
  "cited_facts": [
    {
      "statement": "The Justice Department and CrowdStrike announced on Tuesday that they had disrupted Sality, a peer-to-peer botnet that has been running since 2003.",
      "source": "Decrypt",
      "instrument": "News",
      "claim_key": null,
      "published_at": "2026-09-02T11:30:45.000Z",
      "publisher_count": 1,
      "sources": [
        "Decrypt"
      ]
    },
    {
      "statement": "The Federal Grand Jury in Los Angeles indicted Southworth on three counts of threatening to kill President Donald Trump and additional charges of cyberstalking and harassment against the president's personal lawyer and family.",
      "source": "El Tiempo",
      "instrument": "News",
      "claim_key": null,
      "published_at": "2026-09-03T22:40:00.000Z",
      "publisher_count": 1,
      "sources": [
        "El Tiempo"
      ]
    },
    {
      "statement": "US authorities arrested Benjamin Azariah Southworth, a 40-year-old resident of the Westlake neighborhood of Los Angeles, on September 3, 2026, for threatening to kill President Donald Trump.",
      "source": "El Tiempo",
      "instrument": "News",
      "claim_key": null,
      "published_at": "2026-09-03T22:40:00.000Z",
      "publisher_count": 1,
      "sources": [
        "El Tiempo"
      ]
    },
    {
      "statement": "CrowdStrike estimates that the Sality operator stole at least $150,000 through its primary payload, EggJagger, over the past eight years.",
      "source": "Decrypt",
      "instrument": "News",
      "claim_key": null,
      "published_at": "2026-09-02T11:30:45.000Z",
      "publisher_count": 1,
      "sources": [
        "Decrypt"
      ]
    },
    {
      "statement": "CrowdStrike values the unspent stolen cryptocurrency portfolio at a peak of about 147 million rubles in January 2025, which is roughly the purchasing power of $4 million in a Western capital.",
      "source": "Decrypt",
      "instrument": "News",
      "claim_key": null,
      "published_at": "2026-09-02T11:30:45.000Z",
      "publisher_count": 1,
      "sources": [
        "Decrypt"
      ]
    },
    {
      "statement": "The EggJagger payload monitors the clipboard for cryptocurrency wallet addresses and swaps them for the operator's own addresses, causing victims to send funds to strangers.",
      "source": "Decrypt",
      "instrument": "News",
      "claim_key": null,
      "published_at": "2026-09-02T11:30:45.000Z",
      "publisher_count": 1,
      "sources": [
        "Decrypt"
      ]
    },
    {
      "statement": "Federal prosecutors accused Southworth of publishing the home addresses and phone numbers of the president's lawyer's family members, an act known as doxxing.",
      "source": "El Tiempo",
      "instrument": "News",
      "claim_key": null,
      "published_at": "2026-09-03T22:40:00.000Z",
      "publisher_count": 1,
      "sources": [
        "El Tiempo"
      ]
    },
    {
      "statement": "Prosecutors allege that Southworth used accounts on YouTube, Instagram, TikTok, and a personal website to publicly express hostility toward President Trump and his followers.",
      "source": "El Tiempo",
      "instrument": "News",
      "claim_key": null,
      "published_at": "2026-09-03T22:40:00.000Z",
      "publisher_count": 1,
      "sources": [
        "El Tiempo"
      ]
    }
  ],
  "note": "A signature proves who filed this and that it has not changed since. It never makes a claim true."
}