I am one of the maintainers of the Go implementation of Ethereum proof-of-stake, called Prysm (github.com/prysmaticlabs/prysm) and also implemented a "slasher" in Go that can be used to slash malicious validators. Anyone can run a slasher and you don't need to have 32 ETH to do so. As long as your slasher software can prove that a validator committed a slashable offense, you can submit this proof to any full node to proceed with slashing the malicious actor. It is permissionless, global, and we only need a few honest slashers in the world for the system to work correctly