DPRK and Iran are Leading a 5.2x Surge YoY in Blockchain-Assisted Cyberattacks

Detection signal the summary omits

The page's operational payload for a defender is one line the summary drops: monitor outbound JSON-RPC calls to public blockchain endpoints as a scalable early-warning signal. Compromised machines in every case study reach their C2 by making standard RPC queries (to Cloudflare, Infura, Alchemy, or a self-run node), decoding the returned data, then connecting off-chain. An endpoint with no legitimate blockchain workload making JSON-RPC calls is the observable. This is why the page argues you cannot block your way out: blocking "Ethereum traffic" means blocking every public RPC provider, breaking all legitimate wallet/DeFi use, and the attacker falls back to their own node anyway. Detection and wallet-level attribution — not blocking — are the stated paths forward.

A fourth technique: phantom-wallet C2 (not in the summary)

Beyond transaction-based and contract-based storage, the page describes a stealthier variant. Attackers generate phantom wallets — addresses with no private-key pair — and hide the C2 server's IP address inside the address bytes themselves. They send zero-value transactions to the phantom address; the malware decodes the IP from the address string and connects. Nothing is stored in a transaction field or contract state, so the usual on-chain indicators (calldata, OP_RETURN, contract writes) are absent.

Numbers behind the "surge" claim

The 440% figure has a concrete basis the summary compresses: malicious on-chain writes rose from 2.06 writes/day (before high-capacity open-weight Chinese LLMs) to 11.1 writes/day after, over less than a year. Separately, activity is up 420% over the trailing 12 months. On threat-actor mix: cybercriminals were essentially all BDD activity through early 2024; by Q2 2026 state-linked groups drove roughly two-thirds of new BDD activity per quarter and half of all BDD activity. Tracking spans five major blockchains and 15+ distinct campaigns/clusters.

Lineage (context for triage)

BDD predates EtherHiding by a decade: Necurs stored C2 domains on Namecoin in 2013; 2019 saw C2 IPs encoded into Satoshi transfer amounts and Glupteba writing to Bitcoin OP_RETURN. EtherHiding proper began mid-2023 when ClearFake moved to BSC contracts after Cloudflare takedowns; the Smargaft DDoS botnet was on BSC by late December 2023. This matters for triage: the technique is mature and cross-family, not a single actor's tradecraft.

One added mechanism detail on the DPRK cross-chain relay: the malware queries TRON first and falls back to Aptos, with both resolving to the same BSC transaction — so disruption requires simultaneous action across all three chains.