We went looking for malware on the blockchain. Here is what the chain shows.

01 · A wallet, a burn address, and a count

Five chains, every write, no payload opened

On 8 September, at 13:23 UTC, a wallet on BNB Chain paid a fraction of a cent to send about eight kilobytes of data to an address nobody holds the key to. Nothing happened, and nothing ever does; that is the point. The data was the day's orders for machines this wallet's owners had infected, and the address was chosen because it can never be shut down. The wallet belongs to North Korean hackers that Google named eleven months ago. It had done the same thing 250 times before.

Security researchers call the technique a blockchain dead drop, or EtherHiding. The first phrase comes from spy craft. A dead drop is a hiding place two people share without ever meeting. Here the hiding place is a public blockchain, and the two people are a malware author and the program running on a victim's machine. Google and Guardio Labs have each described one crew's version of it and published a handful of addresses. Nobody has published a count.

Bitquery keeps its own index of BNB Chain, Ethereum, Polygon, Bitcoin and Tron, back to each chain's first block. A dead drop has to be written before it can be read, and every write is a transaction we hold. So we counted the writes ourselves, took the handful of addresses Google had published last October as a starting point, and followed the wallets that paid for them.

One rule shaped every step. We never opened a payload. The malware's code sits on the chain as text, and reading it is safe only for people with a sandbox and a reason. We measured sizes, senders, timing, gas and money instead. Everything that follows was found that way, and it turned out to be enough.

02 · What a dead drop is

A box anyone can read, that only one wallet can write

Malware needs to fetch its next instruction from somewhere, what security people call its command and control, or C2. Which server to call home to, what code to run next. For thirty years that somewhere has been a website or a server, and defenders have killed campaigns by taking the domain or the machine away. A smart contract cannot be taken away.

For this purpose a contract is a small program with a storage box attached. The box is public. Any wallet, any program, any public node can read it for free, and the read leaves no record. Only the owner can write to it, and each write costs a fraction of a dollar. Put the malware's instructions in the box and every infected machine can read them forever, with no login and no server of the attacker's own. The first crew to do it, in 2023, gave it no name. Guardio Labs, who caught them, called the trick EtherHiding.

The victim's machine has to run something first, and that something has to know the contract address. Three doors have been used. The first is a hacked website. The ClearFake crew broke into ordinary WordPress sites, about 14,000 pages by Google's count, and injected a script. A visitor sees a full-page notice that their browser is out of date, or a fake "prove you are human" box, and is told to press Windows+R, paste, and hit Enter. The pasted text installs the malware; security firms call that lure ClickFix. The wording of the notice, the current download link and the keys for the next stage all come out of the box.

The second door is a fake job. A recruiter on LinkedIn moves the chat to Telegram and sends a coding test. Running the test runs a loader whose only job is to read the box and execute what it finds. This is North Korea's Contagious Interview campaign, and the loader Google calls JADESNOW. The third door is a poisoned software package: in June 2025 the same contract was tied to compromised npm packages that developers installed as routine updates.

What comes out of the box is a backdoor. Google's name for it is INVISIBLEFERRET. It gives the crew remote control of the machine and a stealer aimed at Chrome, Edge, MetaMask, Phantom and 1Password. The point is seed phrases and exchange logins. Where that leads is section 07.

03 · The census

How we looked, and what the shape of the writes says

There are two ways to put a payload on an EVM chain without running a server. Store it in a contract's text field, or put it in the data field of a plain transfer to an address nobody controls. The first leaves a contract with one owner, one field rewritten over and over, and no events, the log lines a normal contract leaves for explorers to index. The second leaves a wallet sending large lumps of data to the burn address, 0x…dEaD, where nothing can read it except a program that knows to look.

We scanned both shapes across the full history of BNB Chain and Ethereum: every contract that has ever been handed a long block of text by a caller, and every transfer to the burn address that carried data. The contract calls and address histories behind both are the same tables our customers query.

The filter is crude and it works. Fed nothing but the shape, it returned the original ClearFake contract and the North Korean one on its own, along with a dozen games, DAOs and on-chain art projects that a glance at their function names dismisses. The remaining candidates are the unpublished ones, and most of them belong to the crew in section 06.

Storing code in a contract was the early way. From last year the crews moved to raw transfers, where there is no contract to find and no storage cost, only the gas on the data itself. On BNB Chain that gas has fallen so far that a write the size of a small photo costs about seven cents, and the eight-kilobyte writes of this September under half a cent each. Trend Micro found the contract version alive on the BNB testnet this May, where gas is free, which is the other place it went.

04 · The one everyone published is still live

What happened to the DPRK wallet after October 2025

In October 2025 Google's threat intelligence team described a BNB Chain contract used by a North Korean crew, the wallet that owned it, and three Ethereum transactions holding the backdoor. It counted twenty-odd updates to the contract at about a dollar each. We hold all of it, and the table below has the record. Most of the rewrites carried a few thousand letters of base64, the encoding that turns any file into plain text; a few were short pointers of a few dozen letters. The last rewrite came at the end of May 2025.

The wallet did not stop. From its first day it also posted payloads the second way, as data in transfers to the burn address, and after May 2025 that was the only way it used. It has done so hundreds of times. The most recent write landed ten days before this piece.

The last row deserves a second look. A wallet that served a state-run malware campaign for nineteen months was funded with about sixty dollars, in five small pours, and spent most of it. The cost table in section 09 puts the whole bill, contract and both chains, at about $85.

05 · Where the gas money came from

Three hops from a dead drop to a frozen Tron address

Sixty dollars of gas is a thin thread. The wallet's Ethereum gas came from a fresh address that had been filled the day before, on 5 and 6 February 2025, by four other wallets. One of the four was the owner of a music NFT project, which withdrew its contract's treasury in five calls minutes after receiving a small gas top-up from the fresh address. The other three were ordinary user wallets that made their last transaction ever within the hour they paid in. On chain, that is what a drained wallet looks like. Whether the NFT owner was drained too, or was part of it, the ledger does not say; it kept using its wallet normally for three more weeks, which fits either reading.

The fresh address then sold everything to USDT and pushed it over a bridge called Allbridge to Tron, kept 0.015 ETH back, and paid that to the DPRK wallet the next morning. Smaller shares went to Arbitrum, Polygon and BNB Chain, and every one of them ended at the same Tron address within a month.

The Tron address at the end of every route is TGpCjDZ…7oGfJ. Our labels database lists it as blocked by Tether, and MetaSleuth, a label service we checked against, agrees. In two months it took in a third of a million dollars of USDT from sixteen senders, nearly all of it through the same bridge, and sent almost all of it back out to sixteen more. Thirteen of the senders were Ethereum wallets, each one fresh, each one alive for minutes to hours, each one bridging once. The same funnel appears on BNB Chain, where two of the wallets that paid the DPRK wallet's gas had themselves bridged USDT to Tron. The larger of those went to a second hub that ran over the two months before and paid out to the same three receivers as the first.

Where it went from there is partly labelled. The largest receiver of both hubs, which Tether has also frozen, paid into a Bithumb deposit address. Three Paxful deposit addresses took equal shares from the main hub on a single morning in March. The two biggest downstream pools, which have taken in tens of millions of USDT from hundreds of senders, carry no label anywhere we looked. Following that money further is a Coinpath problem, and the answer so far is a pair of unnamed aggregators.

06 · The crew that started it never left

Twenty unpublished ClearFake contracts, and one evening in December

EtherHiding began in September 2023 with one contract on BNB Chain, deployed by a wallet funded the previous summer. Guardio published the contract a month later. Two years on, Google published six more, the three-contract design the same crew, now called UNC5142, switched to the following autumn. Between those seven sit twenty more, and the wallets tie them together.

The bars show a crew iterating. That October the first wallet funded a second, which deployed a test contract the same afternoon and a working sibling three days later, with the same payload size, to the letter, as the original. The next June a third wallet deployed six contracts in two days, four of them taking raw bytes rather than text, which is the design Google later documented as a router, a logic contract and a storage contract. Those four are the prototype of the three-contract system, five months before it went live.

Then there is one evening in December 2024. Inside half an hour, four of the crew's wallets, including the original one, sent their remaining BNB to a fresh address. That address deployed three contracts in the next eighteen minutes and has not spent a coin since. Two weeks earlier, Google's "main infrastructure" had gone live under a different wallet, funded from OKX. The old generation was retired in one sitting once the new one was running.

One contract in the census matches the family in everything but money. It was deployed in the spring of 2024 by a wallet funded minutes earlier from a Binance hot wallet, and it was rewritten every twelve minutes, day and night, for four months, by one writer, with no events. That flat round-the-clock rhythm is a script. We can say what it looks like and nothing about who ran it.

07 · Who paid

Forty-six wallets emptied token by token, and what that adds up to

The malware does not move money. Money moves when the crew uses a stolen seed phrase, and that transfer looks like any other. So "losses caused by this malware" is not a number the chain can give, and nobody who has studied these crews publishes one. What the chain can give is narrower. Every wallet that bridged into the two hubs was a fresh wallet, alive for minutes to hours. One hop before each of them sits the victim.

The pattern repeats forty-six times. A wallet with years of history sends its whole portfolio to a fresh address, one token at a time, thirty seconds apart: staked ETH, then an altcoin, then another, then the last of its ETH. The fresh address swaps it all to USDT on Uniswap or PancakeSwap and bridges to Tron within the hour. The old wallet never moves again. The LootBot drain we measured this month had the same signature at a larger scale.

Read the table from the bottom up. The hubs are the firmest number, because they are the crew's own ledger. The victim rows are floors: they price only the assets with an obvious dollar value and leave the altcoins, from QNT to PSP to LINK, uncounted. And all of it covers one cash-out pipe for four months, on three of the chains we hold. The pipe went quiet after Tether froze the hub in late March 2025, and its successors were not traced for this piece.

08 · Bitcoin

The same trick without contracts, and without an actor

Bitcoin has no smart contracts, so the same trick has to work differently there: a small payment to a well-known address, with the message in the transaction's note field, so the malware can find it by asking any explorer for that address's history. That is a search we can run. Bitcoin's OP_RETURN field is 80 bytes anyone can write to, and the genesis address receives thousands of tributes a month, so the trick would be to use the famous address as the lookup key and the note as the message.

We found the shape. One wallet pays a thousand satoshis to the genesis address with a short hex string in the note, on a fixed schedule of five days a month, at midnight UTC, and has done so since late 2024. It was funded from a Kraken withdrawal, a predecessor wallet ran the same schedule before it, and the pattern itself goes back to 2020. The age rules out the obvious reading. Whatever this is, a timestamping cron or a heartbeat someone forgot, it predates every dead drop campaign on record, and we do not attribute it.

Better candidates are the three one-day bursts in the last row of the table, fresh wallets doing the same thing once each, the first of them funded from a Crypto.com hot wallet. Without the malware's own decoding logic none of them can be tied to anyone.

09 · What it costs them, and what we can see

Eighty-five dollars, and the only trail that exists

Nobody can delete a contract's storage or a confirmed transfer, and blocking the reads would mean blocking every public node, which would break every wallet on the chain. So the defender's side of this is the one the crews cannot hide. Reads are invisible. Writes are permanent. Who deployed the contract, who writes to it, how often, how big, at what cost, and where the gas came from are all on the record, and that record is what took us from a published wallet to a frozen Tron hub in three hops.

The rule of thumb that fell out of the census is short. A contract with one writer, one text field holding a few kilobytes of scrambled code, no events, a burner deployer funded from an exchange or an instant swap, and writes that arrive in bursts at odd hours is a dead drop until proven otherwise. A wallet that sends 150 KB of data to the burn address is one too.

10 · Method

What we ran, and what could have gone wrong

Every figure comes from Bitquery's own index of the five chains, queried read-only, with no node of our own and no call to any attacker contract. Payload sizes on the burn address are worked out from the gas each write used. Prices are monthly averages from Binance. Labels come from our own database and from one authorised MetaSleuth pass over a hundred addresses.

11 · The record

The addresses behind the story