SKN | North Korean Hackers Drive Blockchain Malware Surge as CoinEx Exits Crypto Market

Key Takeaways

• North Korean and Iranian state-linked actors are driving a sharp increase in malware activity that uses public blockchains to store instructions and infrastructure.
• Blockchain-assisted malware activity has surged more than 400% year over year, increasing cybersecurity and compliance risks for crypto networks and businesses.
• CoinEx is winding down after nine years, citing weaker trading volumes, lower liquidity and rising regulatory and compliance costs across major jurisdictions.

The crypto industry is facing two contrasting developments across Asia: state-linked hackers are expanding their use of public blockchains for malware infrastructure, while CoinEx is preparing to shut down after nearly a decade of operations. Together, the developments highlight how cybersecurity, regulatory costs and declining liquidity are becoming increasingly important factors in the economics of digital-asset markets.

North Korea Fuels Blockchain Malware Expansion

Blockchain-assisted malware activity has increased roughly 420% this year, with North Korean and Iranian-linked groups accounting for the majority of the expansion. State-linked actors represent about two-thirds of newly identified activity involving public blockchains to store malware instructions or infrastructure information.

The technique changes the economics of cyberattacks because information stored on a public blockchain is difficult to remove. Even if conventional domains, servers or code repositories are taken offline, attackers can continue using blockchain-based instructions. Researchers have also identified a North Korea-linked group operating across Tron, Aptos and BNB Smart Chain, demonstrating that the activity is not confined to a single network.

Cybersecurity Becomes a Blockchain-Level Risk

The surge comes as Bitcoin trades around $77,000, with its market capitalization near $1.5 trillion and daily trading activity measured in tens of billions of dollars. While the malware activity represents only a small portion of overall blockchain usage, its persistence creates additional operational risks for exchanges, wallets, developers and institutional users.

For large financial institutions, the issue extends beyond direct theft. Blockchain infrastructure that can host malicious instructions creates additional requirements around transaction monitoring, smart-contract analysis and threat intelligence. The ability to identify suspicious activity without disrupting legitimate decentralized applications is likely to become an increasingly important compliance challenge.

CoinEx Shutdown Reflects Industry Pressure

CoinEx announced that it will cease operations after nine years, citing a prolonged crypto-market downturn, significant contractions in trading volume and liquidity, rising regulatory requirements, compliance costs and operational uncertainty. New registrations stopped on September 15, most non-spot services are scheduled to end on September 22, and spot trading will cease on September 29.

Withdrawals will remain available until December 22. CoinEx has also announced a 0.005 USDT repurchase price for its CET token, while its CoinEx Smart Chain and OneSwap operations are scheduled to end on September 29.

The shutdown illustrates the growing cost of maintaining a global exchange as liquidity becomes more concentrated and regulatory expectations increase. It also shows how operational sustainability can become a differentiating factor even when an exchange remains solvent.

Strategic Outlook for Crypto Infrastructure

The combination of rising blockchain-based cyber threats and CoinEx’s orderly shutdown points to a market increasingly defined by infrastructure quality as well as asset prices. With Bitcoin near $77,000, investors are likely to pay greater attention to exchange liquidity, cybersecurity controls and regulatory resilience. The ability of crypto businesses to manage these risks could become increasingly important as institutional participation expands and governments intensify oversight of digital-asset infrastructure.