State Backed Hackers Fuel Massive Rise in Blockchain-Based Malware Attacks

Cybersecurity researchers have uncovered a dramatic rise in hackers using public blockchains to store and distribute malware instructions. According to a new report from Chainalysis, this type of activity increased by 420% over the past twelve months, with state-sponsored groups responsible for nearly two-thirds of the new cases recorded each quarter.

North Korean Hackers Linked to Multi-Chain Operation

Investigators traced a coordinated campaign across Tron, Aptos, and BNB Smart Chain back to UNC5342, a hacking group associated with North Korea. The attackers reportedly hid encrypted server details inside blockchain transactions, allowing infected devices to locate command infrastructure even after websites or servers were shut down. This approach mirrors an earlier tactic, known as EtherHiding, used in 2025 to hide malicious code within smart contracts.

AI Models May Be Speeding Up Malicious Code Creation

Researchers also noted a 440% jump in harmful blockchain transactions since mid-2025, coinciding with the emergence of open-source AI systems capable of generating malicious code with fewer restrictions.

Iranian Actors Suspected of Using Bitcoin for Covert Signals

Separately, suspected Iranian operatives were found sending coded instructions through Bitcoin transactions linked to a well-known wallet address historically tied to Bitcoin’s creator, though investigators confirmed no direct connection to the attackers.