Writing · September 2026

Reading leaves no trace.

There's a note taped inside the electrical panel on most job sites I ever worked. Whoever is running the job writes the day's changes on it. Every trade that comes through reads it. Nobody signs for reading it, and only the person with the panel key can change what it says. It works because it is public to read and private to write.

That is also, almost exactly, a smart contract. And this month somebody figured out what else you can tape inside the panel.

On September 5, the security firm Netskope published a count of more than 5,400 hacked websites — mostly ordinary WordPress and PrestaShop small-business sites — each injected with a script that fetches its next-stage payload from a smart contract on the BNB Smart Chain testnet. The technique is called EtherHiding. In August, roughly 400 infected sites were calling those testnet endpoints every day, peaking at 536.

It is not one crew. Microsoft Threat Intelligence flagged the same pattern on August 6, tied to the ClearFake operation, warning that a single successful execution can expose credentials, establish persistence and open a path to human-operated ransomware. WatchGuard traced a separate operation doing the same thing on Polygon. Two chains, at least two groups, one idea.

The lure is the dumbest part. You arrive at a real company's website from a search result and get a "verify you're human" box that tells you to open the Windows Run dialog and paste in a command. You do it yourself. Nothing is exploited. You are the exploit.

The transparency runs the wrong way

Here is where most of the coverage has it backwards. The reflex is that blockchains are public ledgers, so anything built on one is traceable, so investigators will simply follow it. That is not what happens.

The injected JavaScript performs an eth_call against the contract. An eth_call is a read. It is not a transaction. It costs no gas, it enters no block, it leaves no entry in the ledger. You can pull that contract's contents a thousand times an hour and nothing, anywhere, records that you did.

The chain faithfully preserves the address book and preserves nothing at all about who opened it.

Every one of those 400-odd daily lookups is invisible on chain.

The testnet detail matters for the same reason. Testnet coin is free and worthless. There is no funding trail, no fee to trace, no exchange to subpoena. The oldest investigative lever in this space is follow the money, and there is no money.

Meanwhile the write side is genuinely locked. Only the wallet that deployed the contract can change what it holds. There is no registrar, no hosting provider, no abuse desk. When a domain is the problem, someone can be served. Here, there is nobody to serve.

The part that is not unstoppable

I wrote node guides for years, and that background is the reason I don't think this is as hopeless as it reads.

The malware is not running a blockchain node. A browser can't. It reaches a public RPC gateway over ordinary HTTPS, and that gateway is a company — with a domain, an operator, terms of service and logs. The contract cannot be seized. The road to it is completely ordinary.

Which makes this a detection you can build this week. If you run a network, outbound traffic from employee workstations to public blockchain RPC endpoints is a strong signal. Almost no office has a business reason for a browser to be chatting with a BNB testnet gateway every sixty seconds. That pattern was invisible when C2 meant a rotating pile of throwaway domains. Now it has a shape.

The one rule

For everyone else, the whole attack collapses on a single habit.

No legitimate human-verification check ever runs on your operating system. A CAPTCHA is a web page. It proves you are a person inside the browser. The instant any site asks you to open Run, or Terminal, or PowerShell, or to paste something into a box that is not part of the browser window, the answer is no. Every time. No exceptions, no matter how normal the site looks — and these sites look completely normal, because they are real businesses whose sites were quietly compromised.

Be especially careful with the phrasing, because it is deliberate. The page usually puts the command into your clipboard for you, then tells you to "paste what you copied." You did not copy anything.

I lost nine bitcoin to security mistakes years ago. Every one of them required me to take an action. The attacker needed my cooperation and got it. That is the shape of this too: a technically impressive piece of infrastructure sitting behind a request that only works if you agree.

The note in the panel works because everyone can read it and only one person can write it. That is a good property for a job site. It is a good property for a blockchain. It is also precisely why it makes such durable infrastructure for someone with bad intentions. The design does not know what it is holding.

Verify everything — starting with the page that's asking you to prove you're human.

— Jon Tetreault, September 2026. The habits, tools, and checks behind this piece are what I teach in Crypto Security Mastery.