Autor Cointelegraph By Ezra Reguerra

Cointelegraph is committed to providing independent, high-quality journalism across the crypto, blockchain, AI, and fintech industries.All news, reviews, and analyses are produced with full journalistic independence and integrity. For more details on our standards and processes, please read our Editorial Policy.

State-linked hackers accounted for roughly two-thirds of new activity each quarter as the number of times attackers stored malware instructions or infrastructure information on public blockchains rose 420% over the past 12 months, according to a Chainalysis report. Chainalysis identified North Korea and Iran-linked operators among the state actors adopting the technique. In one of the report’s findings, the analytics firm connected previously unattributed activity spanning Tron, Aptos and BNB Smart Chain (BSC) to UNC5342, a North Korea-linked group tracked by Google Threat Intelligence. Encoded pointers in Tron and Aptos transactions directed infected devices to the same BSC transaction, with Tron serving as the first route and Aptos as a fallback, Chainalysis reported. The BSC transaction contained encrypted server addresses and configuration data that connected compromised devices to offchain infrastructure used for remote access and data theft. Chainalysis said using public blockchains increases the durability of malware campaigns because the stored information remains accessible after domains, servers or code repositories are taken down. In 2025, North Korean hackers used a similar technique called EtherHiding to place crypto-stealing code in smart contracts.Quarterly share of attributed blockchain dead drop payload writes by threat actor type. Source: ChainalysisAI tools accelerate malicious writesThe company also recorded a 440% increase in malicious blockchain writes since July 2025, when it said high-capacity open-source Chinese artificial intelligence models became capable of producing malicious code with limited safeguards.Eric Jardine, cybercrimes research lead at Chainalysis, told Cointelegraph that they found a “clear point-in-time association,” but could not prove that the actors publishing the malicious transactions and contracts had used the models to increase their output.  Related: Iran eases currency rules to bypass US sanctions with crypto: ReportIran-linked actors put malware directions on BitcoinChainalysis also identified threat actors it suspects are linked to Iran’s Ministry of Intelligence writing encoded command-and-control routing data onto the Bitcoin blockchain. The company said its assessment was based on the malware family, decoding method, timing and server infrastructure associated with previously reported Iranian operations, rather than the blockchain activity alone.Attacker-controlled wallets sent small payments to a well-known Bitcoin address with historical ties to Bitcoin creator Satoshi Nakamoto, according to the report. Chainalysis said the address had no connection to the attackers and served as a permanent public location that infected devices could check for updated directions.The attackers could change their server infrastructure by publishing another Bitcoin transaction, after which infected devices would automatically retrieve the new information. Once the malware obtained those instructions, the operation moved offchain for activities that could include remote access, credential theft and the delivery of additional malware. Magazine: Revolut ID thefts highlight KYC’s dangers: Here’s how to fix it

South Korean police have reportedly referred 18 Polymarket users to prosecutors in an illegal gambling investigation involving 26 people who collectively wagered about 17.6 billion won (worth $12.7 million). According to Asia Economy, data submitted by the National Police Agency to the office of Democratic Party lawmaker Yoon Kun-young showed that the Gangwon Provincial Police Agency had placed 26 people under investigation as of Tuesday and sent 18 of them to prosecutors. The report said the largest amount wagered by a single user was about 5.7 billion won ($4.1 million).Police identified users by analyzing publicly available blockchain transactions, the report said. Polymarket lets users buy and sell contracts tied to the outcomes of real-world events and operates on a noncustodial, peer-to-peer structure with automated settlement. It does not maintain a conventional list of users by their real names, the report said. Authorities reportedly said Polymarket transactions constitute illegal gambling under South Korea’s Criminal Act because users stake assets on outcomes that cannot be predicted with certainty. The users argued that Polymarket should instead be treated as a crypto-based derivatives investment market, according to the report.South Korea moves against PolymarketIn June, Gangwon police launched South Korea’s first illegal gambling probe into local Polymarket users at the request of the National Police Agency. On Aug. 18, South Korean authorities moved to block Polymarket after determining that the prediction market provided an illegal gambling environment to users in the country. The country’s media and communications review commission said the platform’s winner-takes-all structure encouraged speculative gambling, citing Polymarket’s role in operating markets, setting trading rules, providing crypto deposits, withdrawals, and settlement and collecting transaction fees. Related: CFTC, US soldier accused of illegal Polymarket bet spar over interpretation of prediction marketsPolymarket argued that it did not provide Korean-language services or support payments in Korean won and that its noncustodial transactions and use of smart contracts meant it did not directly manage user funds. The commission rejected the argument, saying technical characteristics did not exempt a service from South Korean law.Tae-Lim Kim, managing attorney at AXIS Law, told Asia Economy that the transactions could meet the legal requirements for gambling. He said describing them as prediction derivatives would be difficult to use as a direct defense in criminal proceedings, although the ability to trade contracts and exit positions before settlement could be relevant to a court’s assessment.Magazine: Revolut ID thefts highlight KYC’s dangers: Here’s how to fix it

The Celsius bankruptcy estate sued five BitMEX-linked companies, alleging fraud, market manipulation and wrongful liquidations during the March 2020 market crash. The complaint was filed on Sept. 12 in the US Bankruptcy Court for the Southern District of New York by Celsius entities acting through estate representative Blockchain Recovery Investment Consortium (BRIC). Defendants include HDR Global Trading, ABS Global Trading, Shine Effort, 100x Holdings and HDR Global Services.The estate alleged that BitMEX wrongfully liquidated and seized 1,325.84 BTC in collateral from Celsius on March 12, 2020, and 5,034.33 BTC from investment fund JST the following day. JST subsequently assigned the related claims to the estate, according to the filing. The lawsuit seeks the recovery of Bitcoin worth nearly $490 million at the time of writing, and was filed 11 days before BitMEX is scheduled to stop exchange services on Sept. 23. Cointelegraph reached out to the Celsius estate and BitMEX for comment but did not receive a response before publication. Celsius alleges BitMEX intensified 2020 sell-offThe Celsius estate alleges that BitMEX controlled the prices used to trigger liquidations, the engine that executed them and the insurance fund that received proceeds from some liquidated positions. According to the complaint, some liquidation sell orders were placed at prices more than 24% below the next-best ask available on the platform. It also alleges that Bitcoin traded at a lower price on BitMEX than on competing exchanges as the liquidation cycle intensified.The estate cites the timing of BitMEX’s March 13, 2020, service disruption as evidence for its claim that the exchange’s liquidation engine intensified the sell-off. It alleges that liquidation orders stopped when the platform became unavailable, and Bitcoin’s price then recovered, indicating, in the estate’s view, that forced selling on BitMEX had been suppressing the price.On March 16, 2020, BitMEX said it experienced two distributed denial-of-service attacks on March 13, at 02:16 UTC and 12:56 UTC.The estate is seeking actual damages of at least 6,360.16 BTC or its current value, along with the return of the Bitcoin in kind or its equivalent market value. The complaint also requests statutory damages, punitive and any applicable treble damages, profits BitMEX allegedly earned from the liquidations, and legal fees and costs. The filing does not quantify the additional claims, saying the amounts should be determined at trial.Related: BitMEX delists 65 trading pairs, derivatives in July amid exchange shutdownOn July 23, BKX Services and David Namdar filed a separate proposed class action, alleging they lost a combined 622.66 BTC through forced liquidations. That complaint alleged an internal trading desk could access private customer information and continue trading during server freezes.Responding to the July case, a BitMEX spokesperson told Cointelegraph that it was an “opportunistic claim with no basis” and said the company would vigorously defend itself. The statement concerned the July lawsuit and was not a response to the Celsius complaint.Magazine: Revolut ID thefts highlight KYC’s dangers: Here’s how to fix it