“EtherHiding” deploys in two phases by compromising a website, which then communicates with malicious code embedded in a smart contract.