Why Hackers Are Hiding C2 Servers Inside Empty Ethereum Transfers

Michael Miller · 2026-08-05

Cybersecurity researchers have flagged a clever new twist on an old trick. The EtherHiding blockchain-based command-and-control (C2) technique has evolved, and this time, it's hiding the C2 server IP address inside a made-up destination address of a completely empty Ethereum transfer. It sounds like something out of a spy novel, but it's very real. The new dead drop resolver approach, observed in two trojanized npm packages named "bianira-ui" and "fluid-type-ui," has been codenamed NullReceiver. Let's break down what this means for you and why it matters. ### The NullReceiver Technique: A Closer Look At its core, NullReceiver is a clever way for attackers to hide their command-and-control infrastructure. Instead of using a traditional, easily-flagged server address, they're now embedding the IP address within a fake recipient address on the Ethereum blockchain. The transfer itself is empty—no funds move—but the data hidden inside the recipient field is the real payload. This is a significant step up from previous methods. Earlier versions of EtherHiding used blockchain transactions to store malicious content, but they were easier to spot. NullReceiver takes it a step further by making the transaction look completely innocuous. An empty transfer is common on the Ethereum network, so it doesn't raise any red flags. The attackers are essentially using the blockchain as a dead drop—a place to leave information without direct communication. This makes it incredibly difficult for security teams to track and block the malicious activity. ### How the Attack Unfolds The attack chain starts with the trojanized npm packages. These packages, "bianira-ui" and "fluid-type-ui," look like legitimate UI libraries, but they contain hidden code. When a developer installs one of these packages, the malicious code kicks in and starts scanning the Ethereum blockchain for the specific transaction pattern. Once it finds the right transaction, it decodes the recipient address to extract the C2 server IP. From there, the infected system connects to that server, waiting for further instructions. This could mean anything from downloading additional malware to exfiltrating sensitive data. What makes this so dangerous is the stealth factor. The attack doesn't rely on a hardcoded IP address that can be easily blocked. Instead, the attackers can change the C2 server at any time by simply creating a new Ethereum transaction. This gives them a level of flexibility that traditional malware rarely has. ### Why This Matters for Developers and Security Teams If you're a developer or part of a security team, this should be a wake-up call. The supply chain is becoming a prime target for sophisticated attacks. These trojanized packages show that even trusted repositories like npm are not immune to malicious actors. Here are a few practical steps you can take to protect yourself: - **Audit your dependencies**: Regularly review the packages you use and check for any suspicious updates or changes. - **Use package lock files**: These can help ensure you're getting the exact version of a package you've vetted. - **Monitor network traffic**: Look for unusual outbound connections, especially to blockchain-related services. - **Stay informed**: Follow cybersecurity news to keep up with the latest attack techniques. ### The Bigger Picture: Blockchain's Dual Role Blockchain technology is often praised for its transparency and security, but it's also becoming a tool for cybercriminals. The same properties that make it great for financial transactions—immutability and pseudonymity—make it perfect for hiding malicious activity. NullReceiver is just one example of how attackers are getting more creative. As security measures improve, expect to see even more innovative techniques. The key is to stay one step ahead, which means understanding how these attacks work and taking proactive measures to defend against them. ### Final Thoughts The discovery of NullReceiver is a reminder that the threat landscape is constantly evolving. It's no longer enough to rely on traditional security measures. You need to be vigilant, curious, and willing to adapt. If you're managing a development environment, take the time to review your supply chain. If you're on a security team, keep an eye out for unusual blockchain activity. And if you're just someone who cares about online safety, stay informed. The more you know, the better prepared you'll be. The bad guys are getting smarter, but so are we. By understanding techniques like NullReceiver, we can build better defenses and keep our systems safe. Stay sharp, stay curious, and don't let the complexity of these attacks intimidate you. Understanding is the first step to protection.