- Published on
North Korea drives onchain malware surge, CoinEx shuts: Asia Express
- Authors
- Name
- DeepHorus
A new Chainalysis report has revealed that state-linked hackers, primarily from North Korea and Iran, are responsible for a staggering 420% surge in onchain malware activity this year. The findings underscore how adversarial nations are increasingly using public blockchains as resilient infrastructure for cyberattacks. In a separate but equally notable development, Hong Kong-founded cryptocurrency exchange CoinEx has announced it will cease operations after nine years, citing falling trading volumes, liquidity challenges, and rising regulatory compliance costs. These stories headline this week’s Asia Express roundup, which also covers South Korean gambling prosecutions, Japan’s Metaplanet restructuring, and India’s first tokenized corporate bond pilot.
According to Chainalysis, roughly two-thirds of the new malware activity involved attackers storing malicious instructions or infrastructure information directly on public blockchains. The report also attributed previously unidentified activity on Tron, Aptos, and BNB Smart Chain to UNC5342, a North Korea-linked hacking group. By leveraging public ledgers, these actors make their campaigns far more durable, since the stored data remains accessible even after domains, servers, or code repositories are taken down by authorities. This technique was demonstrated in 2025 when North Korean hackers used a similar method called EtherHiding to embed crypto-stealing code inside smart contracts.
The implications of this shift are significant for cybersecurity teams, who now must monitor blockchain data as part of threat intelligence. Chainalysis noted that the use of public blockchains lowers operational costs for attackers while increasing the difficulty of takedowns. Additionally, NBC reported that North Korea is using remote workers from third countries, including Iran and Lebanon, to pass job interviews at U.S. companies. Once hired, North Korean operatives take over the positions to infiltrate corporate networks and generate funds for weapons programs. This blended approach of technical malware and human infiltration represents a new era of state-sponsored cybercrime.
In South Korea, police have referred 18 Polymarket users to prosecutors as part of an illegal gambling investigation. Authorities identified 26 users in total by analyzing publicly available blockchain data, with the group collectively wagering approximately 17.6 billion won, or about $12.7 million. South Korean law enforcement argues that Polymarket transactions violate the country’s Criminal Act because users stake assets on uncertain outcomes. Since Polymarket does not collect real names or verify identities, investigators relied on onchain tracing to build their case, highlighting both the transparency and regulatory risks of decentralized prediction markets.
In Hong Kong and Japan, corporate governance and regulatory strategy are making headlines. Metaplanet, the Japanese Bitcoin treasury company, has slashed its Series 10 stock pool by 41% following controversy over a plan that would have handed executives up to 20% of fully diluted shares. The company reduced the number of potential shares from 319.464 million to 188.19 million and reset the conversion ratio to its pre-offering level, extinguishing more than $220 million in warrant value and boosting Bitcoin per fully diluted share by about 8.8%. Meanwhile, after the failure of the CLARITY Act in the United States, industry insiders are urging Hong Kong to seize a “critical strategic window.” Allen Ding of Bitfire Research and Shawn Yan of Cregis Technology both emphasized building cross-border infrastructure rather than waiting for any single jurisdiction to define the market.
CoinEx’s shutdown marks the end of a nine-year journey for the exchange. The company said falling trading volumes and liquidity during the bear market, along with rising regulatory and compliance costs, made it impossible to continue sustainably. Withdrawals will remain open until December 22, giving users time to retrieve their funds. The closure reflects a broader consolidation trend in Asia’s crypto sector, where smaller exchanges are struggling to survive amid intense competition and tightening oversight.
On a more positive note, India has launched a tokenized corporate bond pilot with $107 million issued through new market infrastructure. The Securities and Exchange Board of India (SEBI) introduced Demat 2.0, allowing corporate bonds to be issued and held as digital tokens on a distributed ledger. Three companies participated in the pilot, issuing a combined 10.25 billion rupees. This move positions India as a forward-thinking jurisdiction for blockchain-based capital markets, even as other Asian regulators tighten controls on speculative retail trading.
Looking ahead, the Asia-Pacific region is becoming a battleground for crypto regulation and innovation. While North Korean and Iranian cyber threats continue to evolve, governments are also exploring legitimate uses of blockchain technology, from tokenized bonds to compliant trading infrastructure. The coming months will likely see further divergence between jurisdictions that embrace digital assets and those that crack down on unregulated platforms. For now, the message from Asia is clear: security, compliance, and institutional adoption are the new pillars of the cryptocurrency industry.
