State hackers drive 420% surge in onchain malware, Chainalysis finds
Reported by Cointelegraph · AI-assisted summary by ChikoCorp AI News Desk
AI-generated summary based on the linked source; not independently verified. This is not investment advice. Verify market-moving details at the original publisher before acting. See our editorial policy, AI content policy, and financial disclaimer.
Summary
Chainalysis reports a 420% increase in onchain malware activity over the past year, with state-linked hackers responsible for about two-thirds of new activity per quarter. North Korea- and Iran-linked groups use public blockchains to store malware instructions, increasing campaign durability. Chainalysis linked a North Korean group UNC5342 to activity on Tron, Aptos, and BNB Smart Chain, and identified Iran-linked actors embedding malware directions on the Bitcoin blockchain.
Why it matters
According to Chainalysis, storing malware infrastructure on public blockchains prolongs malware campaign lifespans because information remains accessible even if conventional servers are taken down. The rise in blockchain-based malware activity suggests attackers are adopting novel methods that could impact malware resilience and detection. The source does not elaborate further on broader market or policy impacts.
Key context
Chainalysis notes similarities to a 2025 North Korean technique called EtherHiding where crypto-stealing code was embedded in smart contracts. The firm associates increased malicious blockchain writes with the availability of open-source AI models capable of producing malicious code since mid-2025, though direct proof of AI use in this activity is not confirmed. The Iran-linked activity was identified through malware family links, decoding methods, and infrastructure alignment rather than blockchain data alone.
Key numbers and entities
Chainalysis is the reporting analytics firm. UNC5342 is a North Korea-linked group identified by Google Threat Intelligence. The blockchains involved include Tron, Aptos, BNB Smart Chain, Etheruem (via EtherHiding mention), and Bitcoin. The percentage increases reported are a 420% rise in malware-related blockchain activity and a 440% rise in malicious blockchain writes since July 2025. Iran’s Ministry of Intelligence is suspected to be linked to some threat actors.
What remains unclear
The report does not establish direct proof that the malicious actors used AI tools to increase malicious transactions. Details on the specific impact of these malware campaigns on users or markets are not provided. The exact mechanisms of infection and subsequent offchain activities remain broadly described without technical specifics.