A recent report from Chainalysis highlights a 440% increase in blockchain-based malware incidents over the past year. Researchers identify these as blockchain dead drops, where malicious code or instructions are embedded directly into smart contracts and transactions.
The daily frequency of these incidents has risen from approximately two to eleven. State-linked hacking groups, primarily from North Korea and Iran, are responsible for about two-thirds of this activity, whereas their involvement was previously negligible.
Attackers utilize open-source AI tools, including unrestricted models released in mid-2025, to generate and optimize malicious scripts. These tools have lowered the technical barrier to entry for creating complex code that targets developers and infrastructure.
The North Korean group UNC5342 has expanded its operations to include multi-chain relays on TRON and Aptos, in addition to Ethereum and BNB Smart Chain. Transactions for these dead drops typically cost less than $2 each.
While Google researchers first identified related credential theft risks in October 2025, the current data shows an accelerated trend. The industry faces a challenge in mitigating these threats without compromising the core features of public blockchains.
