State‑linked hackers drive 420% rise in on‑chain malware, CoinEx announces shutdown

Chainalysis has identified a dramatic increase in malware that stores its instructions on public blockchains, with activity up 420% year‑to‑date. State‑linked groups from North Korea and Iran are responsible for roughly two‑thirds of this new on‑chain malicious activity.

On‑chain malware surge

According to the report, the majority of the surge is tied to North Korean and Iranian hackers. The researchers highlighted UNC5342, a group linked to North Korea, for previously unattributed campaigns on multiple networks, including Tron, Aptos and BNB Smart Chain. Public blockchains make malware campaigns more durable because the stored data remains accessible even after domains, servers or code repositories are taken down.

Techniques used

In 2025, North Korean actors employed a method called “EtherHiding” to embed crypto‑stealing code directly into Ethereum smart contracts. Similar tactics are now being observed across other chains.

CoinEx to shut down

Hong‑Kong‑founded exchange CoinEx announced it will cease operations after nine years. The decision is attributed to falling trading volumes, reduced liquidity during the bear market, and rising regulatory and compliance costs. Withdrawals will remain open until December 22.

Regional crypto landscape

Fitch Ratings notes that Malaysia is among the most crypto‑curious Islamic nations, with its securities regulator deeming Bitcoin, Ethereum, Ripple and Stellar sharia‑compliant. The report also references other regional developments, such as South Korean police investigating illegal gambling on Polymarket and regulatory proposals in Thailand targeting stablecoin transfers.