State-Sponsored Hackers Fuel 420% Jump in Onchain Malware, Chainalysis

State-linked hackers are increasingly using public blockchains as a durable way to “dead drop” malware instructions and infrastructure details, according to a Chainalysis report cited by Cointelegraph. The firm estimates that roughly two-thirds of new quarterly activity involving these techniques is tied to state-aligned operators, while the frequency of such “dead drop” writes has surged dramatically over the past year.

Chainalysis reports that the number of times attackers stored malware-related payload information on public chains rose 420% in the last 12 months. It also highlights cases involving North Korea- and Iran-linked groups, showing how encoded blockchain data can outlast takedowns of domains, servers, or code repositories.

Key takeaways

• Chainalysis attributes about two-thirds of new dead drop blockchain activity per quarter to state-linked threat actors.
• Dead drop payload writes across public blockchains increased 420% year over year, signaling faster scaling of these tactics.
• Chainalysis linked previously unattributed activity across Tron, Aptos, and BNB Smart Chain to UNC5342, a North Korea-linked group tracked by Google Threat Intelligence.
• Chainalysis also recorded a 440% rise in malicious blockchain writes since July 2025, coinciding with the emergence of higher-capacity open-source AI models.
• Iran-linked actors are suspected to have used Bitcoin to publish encoded command-and-control routing data that infected devices can periodically check.

More “dead drop” payloads on-chain

Chainalysis frames the technique as a way to make malware campaigns harder to disrupt. Instead of relying on websites, domains, or code hosts that can be seized or shut down, attackers encode instructions and infrastructure pointers directly into transactions on public blockchains. The information persists because blockchain data remains accessible even if off-chain components are removed.

In practical terms, the approach improves campaign durability: malware can continue operating as long as it can retrieve updated instructions from the blockchain. Chainalysis notes that in 2025, North Korean hackers used a similar concept—called EtherHiding—to conceal crypto-stealing code inside smart contracts.

North Korea-linked routing across multiple chains

One of Chainalysis’ detailed findings connects activity that previously lacked clear attribution across Tron, Aptos, and BNB Smart Chain (BSC) to UNC5342, a North Korea-linked group tracked by Google Threat Intelligence.

Chainalysis reports that encoded pointers embedded in Tron and Aptos transactions directed compromised devices to the same BSC transaction. In the workflow described, Tron functioned as an initial route, while Aptos served as a fallback if the first path did not work as intended.

The BSC transaction, according to Chainalysis, included encrypted server addresses and configuration data. Those encrypted details tied infected devices to off-chain infrastructure used for remote access and data theft—meaning the blockchain acted as the resilient “messaging layer” while the operational work moved outside the chain once instructions were retrieved.

For investors and builders, this multi-chain structure matters because it increases the surface area responders must monitor. Instead of focusing on a single chain or a single contract address type, defenders may need to track how attackers chain together multiple networks to improve reliability.

AI tools may be boosting malicious on-chain output

Chainalysis also links a surge in harmful blockchain behavior to developments in AI capabilities. The firm recorded a 440% increase in malicious blockchain writes since July 2025, a period it associates with when high-capacity open-source Chinese AI models became capable of producing malicious code with limited safeguards.

Eric Jardine, cybercrimes research lead at Chainalysis, told Cointelegraph that the company found a “clear point-in-time association.” However, he emphasized that Chainalysis could not definitively prove that the actors responsible for the malicious transactions and contracts were specifically using those models to increase output.

This distinction is important. The data indicates timing alignment, but causality remains unconfirmed. Readers should treat the finding as an early warning about how quickly automated code generation tools could lower the cost of producing and deploying blockchain-based malware—without assuming a direct “AI used” attribution for every case.

Iran-linked actors using Bitcoin as a command channel

Beyond North Korea-linked cases, Chainalysis says it identified threat actors it suspects are linked to Iran’s Ministry of Intelligence writing encoded command-and-control routing data onto the Bitcoin blockchain.

Unlike approaches that rely on blockchain activity alone, Chainalysis states its assessment was grounded in a broader set of indicators: the malware family involved, the decoding method, timing patterns, and server infrastructure tied to previously reported Iranian operations.

Chainalysis says attacker-controlled wallets sent small payments to a widely known Bitcoin address with historical ties to Satoshi Nakamoto. The report indicates that this address has no connection to the attackers; rather, it is used as a permanent public location that infected devices could check for updated routing instructions.

According to Chainalysis, the attackers could revise their server infrastructure by publishing another Bitcoin transaction. Once the malware obtained the new instructions, the operation could shift back off-chain, enabling behaviors such as remote access, credential theft, and delivery of additional malware payloads.

From a threat-management perspective, using a familiar and long-lived Bitcoin address complicates takedowns. Even if defenders act against the obvious infrastructure, the blockchain location can remain publicly available and function as a reliable beacon for compromised devices.

Why this trend is likely to keep intensifying

As dead drop techniques spread and as malicious on-chain writes accelerate, the challenge for the ecosystem is not just spotting individual malicious transactions—it’s anticipating how attackers design fallback routes, encrypt payloads, and distribute retrieval logic across chains. The most actionable takeaway for monitoring teams is to focus on behavior patterns around payload writes and encoded routing mechanisms, rather than relying solely on domain or server takedowns.

Going forward, readers should watch whether defenders and analytics firms shift toward cross-chain correlation of encoded instruction flows, and whether future reporting can move beyond “association” to clearer evidence about how AI tooling is operationally integrated into these campaigns.