North Korea, Iran-linked hackers increase blockchain malware use by 420%

Hackers stored malware commands or infrastructure data on public blockchains 420% more often over the past 12 months, with state-linked operators accounting for about two-thirds of new quarterly activity, according to a Chainalysis report. North Korea- and Iran-linked operators were identified among the state actors using this technique. Previously unattributed activity across Tron, Aptos, and BNB Smart Chain was linked to UNC5342, a North Korea-linked group tracked by Google Threat Intelligence. Encoded pointers in Tron and Aptos transactions directed infected devices to the same BSC transaction, with Tron as the primary route and Aptos as the backup. The BSC transaction contained encrypted server addresses and configuration data linking infected devices to offchain infrastructure for remote control and data theft. Chainalysis noted that public blockchains enhance malware campaign resilience by preserving access to stored information even if domains, servers, or code repositories are shut down. In 2025, North Korean hackers used a similar technique called EtherHiding to embed crypto-stealing code in smart contracts.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.