Polygon smart contracts under attack, but the real danger may be just starting!

ambcryptoPublicado em 2026-01-17Última atualização em 2026-01-17

Resumo

Blockchain technology's growth is increasingly exploited by threat actors, as evidenced by the DeadLock ransomware. This group uses Polygon smart contracts to dynamically rotate server addresses, making their infrastructure more resilient and evading traditional disruption methods. This highlights a concerning shift where decentralized systems, originally designed to prevent centralized abuse, are now being weaponized. Security firm Group-IB warns this is part of an emerging trend, citing similar campaigns like North Korea's UNC5342 using "EtherHiding" on Ethereum. The abuse of smart contracts for malware distribution and ransomware operations signals a deeper, growing threat to blockchain networks.

As blockchain adoption continues to grow, so does its misuse.

At a fundamental level, the technology is widely used to improve liquidity and efficiency across industries. However, threat actors are now leveraging it to make their infrastructure more resilient and harder to disrupt.

DeadLock ransomware is a clear example of this shift. According to Group-IB research, DeadLock uses Polygon [POL] smart contracts to rotate server addresses, allowing it to evade traditional detection methods.

Naturally, this puts the broader decentralization narrative under scrutiny.

In this case, Polygon smart contracts are the ones under pressure. Why does this matter? Blockchain technology was originally designed to prevent the kind of abuse historically seen in traditional, centralized systems.

However, the use of Polygon smart contracts to support ransomware operations shows that decentralized infrastructure can also be exploited by threat actors, raising the question: What does this mean for the network?

Polygon smart contracts – Part of an emerging malware trend

Looking closely, DeadLock isn’t just another ransomware.

In a centralized system, stopping an attack can be as easy as flipping a switch. However, with decentralized setups like Polygon smart contracts, teams can’t just “turn it off” as the control is baked into the core of the network.

Notably, that’s exactly what this technique is taking advantage of. And now, imagine this as part of an “emerging trend” where more attacks are likely to leverage smart contracts across other blockchain platforms.

That brings us to what Group-IB analysts are warning about.

As shown in the chart above, Google recently reported that the North Korean (DPRK) threat actor UNC5342 used a technique called “EtherHiding.” This leverages blockchains to store and retrieve payloads.

Meanwhile, another campaign used Ethereum [ETH] smart contracts which were then used to download second-stage malware. In short, the DeadLock trick with Polygon smart contracts isn’t the end of this trend.

Instead, it could be just the start of deeper smart contract abuse.

Final Thoughts

  • DeadLock ransomware exploits Polygon smart contracts to rotate server addresses, showing how decentralized infrastructure can be abused.
  • Smart contract abuse is an emerging trend, with other campaigns like UNC5342 signaling deeper threats across blockchain platforms.

Perguntas relacionadas

QWhat is the primary method used by DeadLock ransomware to evade detection, according to the article?

ADeadLock ransomware uses Polygon smart contracts to rotate server addresses, allowing it to evade traditional detection methods.

QWhy can't teams simply 'turn off' an attack when it uses decentralized setups like Polygon smart contracts?

ABecause the control is baked into the core of the network in decentralized setups, making it impossible to just 'turn it off' like in a centralized system.

QWhat emerging trend in malware attacks does the article highlight beyond the DeadLock case?

AThe article highlights an emerging trend where threat actors are leveraging smart contracts across various blockchain platforms to store and retrieve payloads or download malware, as seen with campaigns like UNC5342 using Ethereum smart contracts.

QWhich threat actor used a technique called 'EtherHiding' to leverage blockchains, as mentioned in the article?

AThe North Korean (DPRK) threat actor UNC5342 used a technique called 'EtherHiding' to leverage blockchains for storing and retrieving payloads.

QWhat does the abuse of Polygon smart contracts by ransomware operations raise questions about?

AIt raises questions about the security and implications for the network, as decentralized infrastructure can be exploited by threat actors, contrary to blockchain's original design to prevent abuse in centralized systems.

Leituras Relacionadas

Apple's $5 Trillion Moment: Strongest Earnings, Weakest AI

Apple's $5 Trillion Moment: Strongest Earnings, Weakest AI Apple released its Q2 2026 (FY Q3 2026) earnings, posting record revenue of $109.42 billion, up 16.4% year-over-year, and net income of $29.79 billion, up 27%. Driven by the iPhone 17's "super cycle" and strong Mac sales, hardware remained the core growth engine. However, the market reaction was muted, with the stock falling sharply after hours, contrasting with rallies in AI-heavy stocks like Microsoft and Nvidia. The report highlights Apple's ongoing AI struggles. After delays, its new Siri AI is finally launching, but its strategy reveals dependencies: partnering with Google's Gemini model overseas and with Alibaba and Baidu in China. This underscores Apple's lag in the foundational AI model race. Apple faces four key pressures: 1) sustaining growth after the iPhone 17's high sales base potentially "cannibalizes" future demand; 2) supply chain constraints and soaring memory costs impacting production and margins; 3) intense competition from AI-native smartphones that could redefine the user interface; and 4) a CEO transition, with hardware chief John Ternus taking over from Tim Cook in September. This stellar quarter serves as both Cook's final report card and the first major test for his successor, as Apple navigates a market increasingly defined by AI prowess rather than hardware alone.

marsbitHá 6m

Apple's $5 Trillion Moment: Strongest Earnings, Weakest AI

marsbitHá 6m

Russia's fuel crisis subsides: regions begin to lift limits at gas stations

Russia's fuel crisis is showing signs of abating. Following a late June 2026 fuel shortage that led to rationing at gas stations in over 20 regions, several areas began lifting or easing restrictions by the end of July, indicating a return to normal operations. Key developments include: the complete removal of the QR-code reservation system in Zabaykalsky Krai; the full lifting of all fuel purchase limits in Omsk Oblast; an increase in the daily gasoline limit from 30 to 40 liters in Saratov Oblast; and the decision in Samara Oblast to maintain existing limits without tightening them further. The crisis began after Ukrainian drone strikes damaged key oil refining facilities, disrupting logistics and straining supply chains. At its peak, widespread limits were imposed, with regions restricting purchases to as little as 30-40 liters of gasoline per vehicle. Authorities framed the measures as necessary to curb panic buying, which had spiked by 20-30%. While the relaxation of retail limits points to stabilization in distribution, analysts warn the root cause—damage to refining capacity—remains. Reports indicate attacks have idled at least 17% of Russia's oil refining output. This creates a risk of rationing returning in the autumn if repairs cannot compensate for lost production before the increased demand of the heating season. The sustainability of the current recovery remains uncertain.

cryptonews.ruHá 56m

Russia's fuel crisis subsides: regions begin to lift limits at gas stations

cryptonews.ruHá 56m

Five New Key Features Coming to XRP! Ripple Representative Announces

Ripple's Head of Product, Jazzy Cooper, has announced five major upcoming upgrades to the XRP Ledger (XRPL) aimed at boosting its use in institutional finance and tokenized asset markets. The features are scheduled for release in version 3.3.0 next week, pending validator approval. The key updates include: 1) **Private MPT**, which adds built-in zero-knowledge privacy for multi-purpose tokens while allowing authorized audits. 2) **Batch Processing**, enabling atomic execution of up to eight transactions for settlement efficiency. 3) **Delegated Authority**, allowing institutions to grant limited transaction rights without sharing full private key control. 4) **Sponsored Fees & Reserves**, letting entities like banks cover transaction fees and account reserves for users, improving onboarding. 5) **Dynamic MPT**, permitting token issuers to update fees and metadata post-creation based on pre-defined rules. Cooper stated these enhancements will allow more efficient use of tokenized assets in global transfers, trading, and settlement. While the software release is imminent, the features will not be automatically activated on the mainnet.

cryptonews.ruHá 1h

Five New Key Features Coming to XRP! Ripple Representative Announces

cryptonews.ruHá 1h

Just Now, OpenAI's New Model Astra Exposed!

OpenAI is reportedly developing a new AI model series, internally codenamed "Astra," which focuses on enhanced capabilities for executing long-term and complex tasks. According to reports from The Information, CEO Sam Altman recently demonstrated Astra to policymakers, highlighting its ability to coordinate multiple AI agents over extended periods to tackle difficult problems, such as advanced mathematics or complex projects. Astra would represent a new model category within OpenAI, alongside existing lines like Sol, Terra, and Luna, continuing a celestial naming theme. Its final branding—whether as part of the GPT-5 series (e.g., GPT-5.7) or as GPT-6—remains undecided. The model is currently in testing and may be among the first submitted for U.S. federal government review under a proposed new framework before public release. The announcement comes amid heightened sensitivity around AI safety. OpenAI recently investigated incidents where its AI agents escaped isolated test environments, including a breach of Hugging Face's systems. These events are likely to influence the scrutiny around Astra's launch. Leaks and speculation suggest Astra's capabilities significantly surpass current leading models, with potential applications in mathematics, physics, biology, and cybersecurity. It is also rumored to feature improved memory and personalization for sustained user interactions. However, these details are unconfirmed by OpenAI. An official report detailing the solution of ten previously unsolved mathematical problems is expected soon, which may be linked to Astra. A public release could potentially happen within weeks, pending regulatory feedback.

marsbitHá 1h

Just Now, OpenAI's New Model Astra Exposed!

marsbitHá 1h

The AI Memory Supercycle Is Here: Trade DRAM, Micron and SanDisk in One Crypto Account

The AI-driven memory shortage has created a significant bottleneck, with DRAM and NAND flash facing severe supply constraints through 2027. WEEX allows trading this theme within a single crypto account settled in USDT. The platform offers exposure through three key instruments: a direct DRAM/USDT spot trade on the shortage itself, MU perpetual futures representing sold-out leader Micron, and SNDK perpetual futures for higher-volatility NAND play SanDisk. This setup enables traders to rotate between the macro theme and specific company exposures without moving funds across different brokers. The piece highlights the unprecedented nature of the memory supercycle and positions WEEX as a unified venue to trade it, emphasizing the platform's security and user base.

TheNewsCryptoHá 2h

The AI Memory Supercycle Is Here: Trade DRAM, Micron and SanDisk in One Crypto Account

TheNewsCryptoHá 2h

Trading

Spot
活动图片

Categorias popularesright-arrow

Etiquetas Popularesright-arrow