A new report from Chainalysis reveals that the frequency of attackers storing malware instructions on public blockchains has surged by 420% over the past 12 months. State-sponsored hackers are responsible for approximately two-thirds of this new activity each quarter.
The firm linked North Korean hackers, specifically the group UNC5342, to malicious activity across the Tron, Aptos, and BNB Smart Chain networks. These actors used encoded pointers in transactions to direct infected devices to offchain infrastructure for data theft.
Additionally, Chainalysis identified actors suspected of ties to Iran’s Ministry of Intelligence using the Bitcoin blockchain. These operators embedded command-and-control routing data into transactions sent to a public address historically associated with Satoshi Nakamoto.
The use of public blockchains provides increased durability for malware campaigns, as stored data remains accessible even if traditional servers or domains are disabled. This technique allows attackers to update their infrastructure remotely.
Chainalysis also noted a 440% increase in malicious blockchain writes since July 2025. The firm suggests this rise correlates with the availability of high-capacity open-source AI models capable of generating malicious code.
