Ethereum Malware: BSSN Warns of HashHiding Mode

Ethereum malware has come under scrutiny after Indonesia's National Cyber and Crypto Agency (BSSN) warned about a technique called HashHiding, which uses Ethereum transactions to help malware locate its command server. Through this method, hackers can conceal information about a Command and Control (C2) server in the destination address of a blockchain transaction. Malware that has already infected a victim's device then reads this information.

The findings show how blockchain technology, known for its transparency, can also be misused for cybercrime. However, this does not mean that the Ethereum network has been hacked or that ETH transactions can directly spread malware. The real threat arises when attackers use blockchain data as a communication channel with devices they have already compromised.

Key Takeaways

• BSSN has warned about HashHiding, a technique that uses Ethereum transactions to conceal information about malware command servers.
• HashHiding does not infect the Ethereum blockchain; instead, it uses transaction data to facilitate malware communications.
• Crypto users should watch out for suspicious software, verify code sources, and protect their devices and wallets.

Ethereum Malware: What Exactly Did BSSN Warn About?

Ethereum is widely known as a blockchain network that supports cryptocurrency transactions and smart contract applications. However, the openness of its transaction data, one of its defining characteristics, can also be exploited by cybercriminals.

In a warning issued in November 2026, BSSN highlighted the use of HashHiding to conceal malware command-server information within Ethereum transactions.

This information allows malicious software that has already infected a device to locate communication infrastructure controlled by hackers.

Importantly, this attack does not work by sending malware directly through ETH transactions. The blockchain merely stores information that malicious software later retrieves.

The threat is especially relevant to people who frequently download applications, run code from public repositories, or work in software development.

BSSN also emphasized the importance of checking application sources and avoiding the execution of code whose security has not been established.

Read also: Beware! OJK Shuts Down 16 Illegal Investment Entities, Including AI and Crypto Schemes

What Is HashHiding Malware?

HashHiding is a technique that allows hackers to hide information about the location of a malware command server within blockchain transaction data.

In the implementation observed on Ethereum, this information is embedded in specially crafted transaction recipient addresses. These addresses do not transmit viruses; instead, they serve as clues for malware already running on a victim's device.

By reading the relevant transaction information, malware can determine where to connect to receive further instructions.

This means attackers do not always need to store a server address directly in malicious code. If their infrastructure changes, hackers can update the clue that the malware subsequently reads from the blockchain.

The technique is related to the concept of a blockchain dead drop, in which blockchain data serves as a place to store information that designated software can later retrieve.

Put simply, hackers use public transaction records as a bulletin board for malware.

How Do Hackers Exploit Ethereum Transactions?

To understand HashHiding, it helps to consider one of Ethereum's basic features: transactions recorded on the blockchain are publicly accessible.

Under normal circumstances, this allows users to verify asset transfers and network activity.

However, the same publicly available data can also be used to store information for other purposes.

With HashHiding, the attack generally unfolds as follows:

1. The victim's device is infected first. Malware enters through malicious software, modified code, or social engineering.
2. The malware reads blockchain information. The program accesses Ethereum transaction data associated with the attacker's communication mechanism.
3. A clue to the server is found. Information hidden in a transaction's destination address is used to identify the location of the C2 server.
4. Communication with the hacker begins. The malware contacts that infrastructure to continue its activities.
5. The server location can be updated. Attackers can change the communication clues without reinstalling the malware on the victim's device.

This sequence makes it clear that Ethereum is not the source of infection. The malware must already be on the device before it can use blockchain information to locate its command server.

In other words, sending ETH, receiving transactions, or viewing blockchain history does not automatically expose a device to a HashHiding attack.

Read also: MSTR Removed from MSCI: Are Strategy's Bitcoin Purchases at Risk?

Understanding Command and Control (C2) in Malware Attacks

The term Command and Control , or C2, may sound technical, but its function is straightforward. C2 refers to the infrastructure hackers use to communicate with malware-infected devices.

Through these servers, attackers can send instructions, receive information from victims' devices, or control malicious software according to its capabilities. A problem for the hackers arises when security teams discover and block those servers.

If malware knows only one server address, communication may stop when that infrastructure becomes unavailable. HashHiding provides another way to locate a replacement server.

Rather than depending entirely on an address embedded in the program, malware can read new clues from Ethereum transaction data. That is why the technique has attracted the attention of cybersecurity researchers.

Addressing the threat requires more than blocking a single server. Suspicious activity on devices and unusual network communication patterns must also be examined.

Read also: Ripple BI-FAST Returns to the API, with a Rp100 Million Transfer Limit

What Is the Difference Between HashHiding, EtherHiding, and TxDataHiding?

HashHiding is not the only technique that uses blockchains to support malware activity. Researchers have also identified approaches known as EtherHiding and TxDataHiding. Although their underlying concepts are related, they do not necessarily exploit the same parts of a blockchain.

With HashHiding, attackers use transaction address information as a signaling channel.

EtherHiding takes a different approach by using smart contract data in certain malware campaigns.

Meanwhile, TxDataHiding uses the transaction data field to hide information needed by malicious software. These differences show that attackers are not limited to a single blockchain feature.

They continue to look for ways to exploit available technologies to support communications and distribute attack components.

Read also: iOS Security Vulnerability Threatens Seed Phrases, Binance Issues Warning

Why Has HashHiding Become a Concern in 2026?

HashHiding is more than a theoretical concept discussed by security experts. On September 25, 2026, a technical study revealed its use in the evolution of a malware campaign known as Cross-Chain TxDataHiding (XCTDH).

The campaign was previously known to exploit several blockchain networks, including BNB Smart Chain, TRON, and Aptos. The use of Ethereum adds another way for attackers to hide information that malware needs for communication.

Researchers' observations over approximately 90 days showed relatively consistent activity.

The figure of 2,655 transactions represents the signaling activity detected by researchers, not the number of infected victims. Likewise, the four C2 endpoint changes indicate shifts in communication infrastructure, not four separate attacks.

The findings demonstrate that blockchains have actually been used as part of malware communication mechanisms. Researchers also linked the XCTDH campaign to cyberthreat activity associated with North Korea.

Nevertheless, that attribution does not mean all malware that uses blockchains originates from the same group.

Read also: Binance Hack: Hackers Launder Money Through 6 Meme Coins—Here's How

Who Might Be Targeted by HashHiding?

In the XCTDH campaign, software developers were among the groups of particular concern. They often work with code from multiple sources, install dependencies, and access project repositories that may not all be trustworthy.

Hackers can exploit these practices to plant malicious software in projects or packages that appear legitimate. One pattern identified in related campaigns involved fraudulent job offers.

Victims were asked to try a programming project or run code as part of a seemingly credible recruitment process. Unbeknownst to them, the files they executed contained malware.

Similar attacks may also involve compromised GitHub repositories or modified software packages. Depending on the malware and its delivery method, the threat may affect Windows, macOS, or Linux environments.

However, this does not mean every user of those three operating systems is automatically vulnerable to HashHiding. The primary risk remains running malicious software or granting access to untrusted parties.

Can Ethereum Wallets Be Infected with Malware?

When people hear the phrase Ethereum malware, they may immediately worry about the safety of the ETH they hold. In reality, owning Ethereum or making ordinary transactions does not automatically infect a wallet or device with malware.

Problems arise when a device used to access digital assets is already infected. Information-stealing malware, for example, may try to collect browser data, login credentials, or other sensitive information stored on a computer.

In the XCTDH campaign, researchers identified malicious components capable of stealing information from various applications.

That is why protecting crypto assets involves more than choosing the right wallet. The security of the device used to access that wallet also deserves attention.

What About MetaMask and Other Wallets?

Wallets from legitimate providers can still be exposed to risks if users' devices have been compromised. For example, malware running on a computer may try to steal sensitive information or manipulate user activity.

There is also the separate risk of approving malicious transactions without carefully reviewing them. Users should therefore keep their devices secure, store their seed phrases properly, and check transaction details before approving anything.

Read also: Cyberattacks on Indonesian Banks: 214,000 Incidents—Are Customer Funds Safe?

5 Ways to Avoid Crypto Malware

The HashHiding threat shows that protecting digital assets starts with the devices people use every day.

Not every attack can be prevented, but a few straightforward habits can reduce the risk.

1. Download Applications from Official Sources

Use official websites when downloading wallets, trading applications, or supporting software. Do not immediately install applications sent through unfamiliar links, even if they resemble popular products.

2. Check Repositories and Developer Identities

If you use GitHub or npm, take time to review a project's source before running its code. Check the maintainers' identities, change history, and whether the project genuinely comes from the claimed developer.

3. Avoid Running Code You Do Not Understand

Be cautious of messages asking you to run commands to fix an application issue, attend a job interview, or complete a technical task. If you do not understand what a command does, do not run it on a device used to store crypto assets.

4. Keep Your System and Security Software Updated

Software updates often include fixes for known vulnerabilities. Make sure your operating system, browser, and essential applications are running versions that still receive security support.

5. Protect Access to Your Wallets and Crypto Accounts

Enable multifactor authentication on accounts that support it. Never share your seed phrase or private key, and avoid storing them in files that other applications can easily access.

For certain digital asset holdings, a hardware wallet may provide an additional layer of protection, although it cannot eliminate every risk.

Read also: PEPE and UNI Bought by a Wallet Suspected of Links to the Binance Hack

What Should You Do If You Suspect Your Device Is Infected?

A device suddenly slowing down or malfunctioning does not necessarily mean it has malware. However, unfamiliar account activity, repeated security alerts, or unauthorized wallet transactions warrant investigation.

If you suspect an infection, temporarily stop using the device for financial activities or crypto transactions. Use another trusted device to change your passwords and review account security.

Also check active login sessions, connected applications, and access permissions that may have been granted to others. If you suspect your private key or seed phrase has been exposed, do not continue using it to store assets.

Consider moving any assets that can still be secured to a new wallet, using a clean device and trusted procedures.

For users working with corporate systems or development projects, an assessment by a security team may help identify the source of the problem and appropriate recovery measures.

A single clean antivirus scan is not necessarily enough to confirm that every threat has been removed.

How Does HashHiding Affect the Crypto Industry?

Blockchain technology is designed to support transparent transactions and recordkeeping. However, as with other open technologies, its features can also be put to unintended uses.

In the case of HashHiding, publicly accessible transaction information is exploited as part of malicious software communications. For the crypto industry, this finding reinforces the need to strengthen software security and development environments.

Companies need to exercise greater caution with third-party dependencies, suspicious code changes, and network activity that does not match their systems' legitimate needs.

At the same time, the transparency of blockchain data gives researchers an opportunity to identify transaction patterns associated with attacks. In other words, the technology exploited by attackers can also provide valuable evidence for investigations.

It is important to emphasize that there is no basis for concluding that HashHiding disrupts Ethereum's consensus system or directly affects the price of ETH.

The issue involves the misuse of blockchain data for malware communications, not damage to the Ethereum network itself.

If you want to stay informed about Ethereum security, Bitcoin, and blockchain technology, you can sign up for Bittime to receive regular market updates, crypto news, and the latest analysis.

Conclusion

BSSN's warning about Ethereum malware sheds new light on how hackers exploit blockchain technology beyond its intended functions.

Through HashHiding, attackers store clues to Command and Control servers in Ethereum transactions so malware that has already infected a device can locate its command infrastructure.

Even so, the Ethereum network does not automatically become a source of malware infections. Ordinary ETH transactions do not directly infect devices either.

The more relevant risks come from malicious software, unverified code, and manipulation that persuades victims to grant attackers access.

For crypto users and developers alike, device security remains one of the most important safeguards. Understanding where software comes from, protecting credentials, and exercising care when running code can help reduce the risk of similar attacks.

Bittime is a licensed Digital Financial Asset Trader (PAKD) platform regulated and supervised by Indonesia's Financial Services Authority (OJK)— where you can buy Bitcoin in Indonesia and hundreds of other crypto assets starting from Rp10,000. Registration is fast and secure, and you can get started today.

Track the USDT to IDR conversion rate and real-time price movements of your favorite crypto assets. Everything is available in one crypto investment app that you can download for free from the Play Store.

Ready to get started? Sign up for Bittime now and put your investment strategy into action on a platform trusted by millions of users in Indonesia.

FAQ

What Is the Ethereum Malware BSSN Warned About?

BSSN's warning concerns HashHiding, a technique that uses Ethereum transactions to conceal the location of a malware command server. It does not mean the Ethereum network has been infected. Blockchain data serves as a communication clue for malware that is already present on a victim's device.

What Is HashHiding and How Does It Work?

HashHiding hides Command and Control server information in the destination addresses of Ethereum transactions. Malware that has infected a device reads this information to locate a server controlled by hackers. The technique allows the location of the communication infrastructure to be updated without reinstalling the malware.

Can Ethereum Transactions Spread Malware?

Ordinary Ethereum transactions do not automatically install malware on users' devices. In HashHiding, transactions serve as a way to store information, not as a direct infection mechanism. Malware still needs another means of entering a device.

Are Ethereum Wallet Users at Risk from HashHiding?

The risk arises when a device used to access a wallet has been infected with malware. Holding ETH or using an official wallet does not automatically trigger a HashHiding attack. Device security and private key protection therefore remain essential.

How Can You Avoid Malware That Exploits Blockchain Technology?

Use applications from official sources, inspect repositories before running code, and avoid suspicious commands delivered through messages or fake job offers. Keep your system updated and enable multifactor authentication on important accounts. If you suspect an infection, carry out a security assessment before using the device for crypto transactions again.