North Korean Hackers Hide Malware inside Smart Contracts

[nihalsari]

Google’s Threat Intelligence Group says North Korean-linked actors have adopted “EtherHiding”, a technique that embeds malicious payloads in smart contracts on public blockchains to steal crypto and data. Attackers first compromise legitimate websites (often via fake job outreach), then use JavaScript loader scripts that trigger the on‑chain payload when victims interact. The method avoids normal takedowns because the malicious code lives in immutable contracts on networks like Ethereum and BNB Chain.

[kelson10]

State-backed actors are embedding malicious code in smart contracts to bypass traditional defenses.

[alex10]

This highlights the urgent need for smart contract audits and automated threat detection.