State Hackers Turn Blockchains Into Malware Parking Lots, Chainalysis Reports 420% Surge 🦠

State-linked hacking groups accounted for roughly two-thirds of new malicious onchain activity each quarter, as the total number of blockchain-based malware storage events climbed 420% over the past 12 months, according to a Chainalysis report. The analytics firm identified North Korea and Iran-linked operators among the state actors adopting the technique, with North Korean hackers alone responsible for a similar method called EtherHiding that placed crypto-stealing code in smart contracts during 2025.

Chainalysis connected previously unattributed activity spanning Tron, Aptos and BNB Smart Chain (BSC) to UNC5342, a North Korea-linked group tracked by Google Threat Intelligence. Encoded pointers in Tron and Aptos transactions directed infected devices to the same BSC transaction, with Tron serving as the primary route and Aptos as a fallback, according to the report. The BSC transaction contained encrypted server addresses and configuration data linking compromised devices to offchain infrastructure used for remote access and data theft. Chainalysis said using public blockchains increases the durability of malware campaigns because stored information remains accessible even after domains, servers or code repositories are taken down.

The company also recorded a 440% increase in malicious blockchain writes since July 2025, a rise it tied to high-capacity open-source Chinese artificial intelligence models becoming capable of producing malicious code with limited safeguards. Eric Jardine, Chainalysis cybercrimes research lead, told Cointelegraph that researchers found a "clear point-in-time association" but could not confirm that the actors publishing the malicious transactions and contracts had used the models to increase their output.

Separately, Chainalysis identified threat actors it suspects are linked to Iran's Ministry of Intelligence writing encoded command-and-control routing data onto the Bitcoin blockchain. The assessment was based on the malware family, decoding method, timing and server infrastructure associated with previously reported Iranian operations rather than on the blockchain activity alone. Attacker-controlled wallets sent small payments to a well-known $BTC address with historical ties to Bitcoin creator Satoshi Nakamoto, an address Chainalysis said had no connection to the attackers and served only as a permanent public location infected devices could check for updated instructions.