Blockchain-based systems are distinguished by a combination of decentralized consensus, peer-to-peer communication, transaction propagation, smart contract execution, and application-layer services across multiple interacting layers. This structural interdependence creates blockchain-specific attack surfaces and facilitates the propagation of adversarial behaviors across protocol, network, data, infrastructure, contract, and application components. Existing blockchain security studies have primarily focused on vulnerability classification and layer-based attack analysis; however, they offer limited support for modeling the evolution of multi-stage attacks involving layer-specific assets and blockchain-native adversarial behaviors. This paper introduces BRIGID, a blockchain-specific threat modeling framework grounded in tactics, techniques, and procedures (TTPs). BRIGID identifies security-relevant assets and attack surfaces across six blockchain layers and derives blockchain-specific tactics and techniques through layer- and asset-driven analysis. The resulting taxonomy defines 13 tactics and 44 techniques tailored to the structural characteristics of public blockchain systems and applications. Based on this taxonomy, BRIGID defines a threat modeling workflow encompassing asset identification, TTP mapping, attack flow construction, and cross-layer attack path analysis. The applicability of BRIGID is demonstrated through two real-world case studies, which show that BRIGID supports structured analysis of cross-layer attack propagation and complements the MITRE ATT&CK framework in modeling adversarial behavior in public blockchain environments. This paper establishes a structured foundation for threat-informed security analysis and systematic modeling of cross-layer attack paths in blockchain systems.
