Trustwave said it believes the crime ring is still operating, though it does not know who is running the group. The company said it has disrupted the servers that were controlling machines infected with Pony, but expects the group to launch more attacks on virtual currency users.
A representative for the Bitcoin Foundation, a trade group that promotes adoption of the digital currency, did not immediately respond to requests for comment.
(Read more: How investors should play the cybersecurity war)
Trustwave's discovery comes in the wake of an unrelated cyber attack that spammed bitcoin exchanges earlier this month. That attack prompted at least three online virtual currency traders to halt withdrawals, causing bitcoin's value to plunge 33 percent over three weeks.
Bitcoin is a digital currency sustained by software code written by an unknown programmer or group of programmers. It is not governed by any one company or person, and its value is determined by user demand.
People who buy digital currency can store it in virtual wallets on their own machines or with companies that offer storage and security services.
(Read more: Bad business: Dumb mistakes made in cyberspace)
Mador said digital currency theft is still in its infancy, but that it is likely to grow.
"If digital currencies become more popular, this type of campaign is likely to get much bigger," he said.
Digital currency buyers can easily protect themselves from hackers by encrypting digital currency files, Mador said.