North Korean threat groups, including Famous Chollima and UNC5342, are leveraging blockchain technology to conceal malware payloads within smart contracts, a technique dubbed EtherHiding. This marks the first documented instance of a nation-state actor adopting such methods, as confirmed independently by Cisco Talos and Google Threat Intelligence Group. The attacks primarily target job seekers through fake recruitment processes, where perpetrators impersonate companies like Coinbase and Robinhood to distribute malicious software.
The malware families involved—BeaverTail, OtterCookie, JADESNOW, and INVISIBLEFERRET—feature keylogging, screenshot capabilities, and backdoor functions. They are distributed via GitHub repositories and the official NPM repository, such as a package named node-nvm-ssh disguised as a chess application called Chessfi. Since February 2025, UNC5342 has embedded payloads in smart contracts on the BNB Smart Chain and Ethereum, using read-only function calls to avoid transaction fees and obscure blockchain history.
EtherHiding creates a decentralized command-and-control infrastructure that is resilient to takedowns, as public blockchains cannot be easily altered or removed by law enforcement. Attackers have updated contracts over 20 times within four months, with an average gas fee of $1.37 per update. The malware retrieves payloads through API providers like Binplorer, Blockchair, and Ethplorer, and targets over 80 browser extensions, including MetaMask and Phantom, to steal cryptocurrency and credentials.
This campaign, known as Contagious Interview, has contributed to North Korean hackers stealing over $1.3 billion across 47 incidents in 2024 and $2.2 billion in the first half of 2025 alone, funding the regime's weapons programs. Fake US corporations, such as Blocknovas and Softglide, have been established to lend credibility to these schemes. Binance founder Changpeng Zhao has warned of similar attack vectors, including fake job applications and malware-laden links, citing a major incident that resulted in over $400 million in losses.
U.S. authorities have seized over $7.7 million in crypto linked to these operations, while cybersecurity firms recommend enhanced verification of job offers and monitoring for indicators of compromise to mitigate risks.
BTC
JUP
SOL
PEPE
USDC