Onchain attacks are accelerating fast, with new research from Chainalysis pointing to a sharp rise in malware activity across public blockchains. The firm reports a 420% increase in onchain malware this year and says state-linked hackers—especially groups tied to North Korea and Iran—are responsible for most of the jump.

Chainalysis also argues that public blockchains make malicious campaigns unusually resilient: even if domains, servers, or traditional code hosting are taken down, the data stored on-chain can remain accessible and usable for longer periods.

Key takeaways

Chainalysis attributes the majority of this year’s 420% surge in onchain malware to state-linked hackers, particularly those linked to North Korea and Iran.
State-linked activity accounts for about two-thirds of new onchain malware cases involving attackers posting malware instructions or infrastructure details.
Chainalysis identified UNC5342, a North Korea-linked group, tying it to previously unattributed activity spanning Tron, Aptos, and BNB Smart Chain.
Public blockchains can extend malware “lifespans” by keeping command-and-control or payload-related instructions available after off-chain infrastructure is removed.

State-linked activity drives the onchain malware spike

Chainalysis’ report centers on how attackers are increasingly using public blockchains not just to move funds, but to store malicious instructions and supporting infrastructure information. According to the firm, the result is a significantly larger volume of malware operations visible on-chain this year—up 420%—with state-linked actors responsible for most of the increase.

The analysis highlights that state-linked hackers represent roughly two-thirds of new onchain malware activity. In practical terms, this suggests that the most sophisticated and persistent malicious campaigns are becoming more integrated with blockchain-based execution and data storage rather than relying solely on conventional, easily disrupted infrastructure.

Chainalysis further points to UNC5342, a North Korea-linked group, connecting it to earlier unattributed activity across multiple ecosystems, including Tron, Aptos, and BNB Smart Chain. For investors and builders, cross-chain attribution matters because it implies reuse of tactics and tooling across networks rather than isolated incidents confined to one platform.

Why public blockchains can make malware harder to eliminate

One of Chainalysis’ most important arguments is that onchain storage changes the operational economics of malware. Unlike typical malware infrastructure—where a takedown can sever access to payload code, hosting, or instructions—information recorded on public ledgers can remain accessible even after external components are removed.

Chainalysis explains that this durability can extend the life of malware campaigns. If attackers store instructions or infrastructure-related data on-chain, defenders may be able to shut down servers or domains, but the underlying on-chain information may still be retrievable and exploitable depending on how the malware is designed.

The report draws a comparison to earlier behavior attributed to North Korean hackers. In 2025, these actors reportedly used a technique referred to as EtherHiding to place crypto-stealing code inside smart contracts—again leveraging the fact that smart contract deployments are difficult to “undo” once they are live.

Attribution across chains signals broader threat tooling

Chainalysis’ identification of UNC5342 across Tron, Aptos, and BNB Smart Chain emphasizes a trend security teams have increasingly observed: attackers are treating chains as interchangeable environments for distribution, execution, or storage of malicious components.

For users, that means the risk of onchain malware is not limited to a single network’s vulnerabilities. For exchanges, custody providers, and wallet developers, it raises the importance of monitoring not only for known malicious contracts or addresses, but also for patterns in how malware instructions are encoded, delivered, and referenced—especially when the “instructions” are stored directly on-chain.

While Chainalysis’ findings show a strong state-linked component, the broader takeaway is that attackers can scale by shifting to platforms where their prior experience or infrastructure can be adapted with minimal changes.

What to watch next in onchain defense

As Chainalysis reports more state-linked actors adopting onchain methods, the immediate focus for the market should be on faster detection of onchain malware patterns and more robust controls around smart contract interactions, data indexing, and monitoring of malicious instructions stored on-ledger.

Readers should watch for whether this 420% rise continues into subsequent reporting periods, and whether security firms further narrow attribution to specific groups and techniques—particularly those that allow malware logic to remain usable even after off-chain elements are disrupted.