State-backed hackers have fueled a dramatic 420% jump in onchain malware activity, with groups tied to North Korea and Iran increasingly weaponizing blockchain networks to run and hide their operations, according to new research from blockchain analytics firm Chainalysis.
How State Actors Are Exploiting Blockchains
The findings point to a growing trend in which nation-state hacking groups abuse public blockchains not to steal funds, but to sustain their malicious infrastructure. Chainalysis reported that North Korea-linked operatives leaned on networks including Tron, Aptos and BNB Chain to keep their malware systems running.
The appeal for these actors lies in the resilient, decentralized nature of blockchain technology. Because onchain data is difficult to censor or take down, attackers can embed instructions and coordination points that are far harder for authorities to disrupt than traditional servers.
Attackers are turning the immutable, censorship-resistant design of blockchains into a shield for their own malicious infrastructure.
Meanwhile, actors suspected of ties to Iran took a different approach, embedding operational directions directly within Bitcoin transactions. That technique allows malware to receive commands through the blockchain itself, blending malicious signals into otherwise ordinary transaction data.
What the Surge Means for Security
The staggering 420% increase underscores how quickly blockchain-based malware techniques are being adopted by sophisticated threat groups. As legitimate crypto adoption grows, so too does the surface area for abuse by well-resourced state actors.
Security researchers have long warned that the same properties making blockchains valuable for finance and record-keeping can be exploited for illicit ends. The latest data suggests those concerns are materializing at scale.
Key takeaways from the Chainalysis findings include:
- North Korea-linked groups used Tron, Aptos and BNB Chain to maintain malware infrastructure
- Suspected Iran-linked actors embedded commands within Bitcoin transactions
- Onchain malware activity climbed 420%, signaling rapid adoption of these tactics
For blockchain networks and the broader crypto ecosystem, the report is a reminder that combating illicit activity requires constant vigilance and improved monitoring, even as the technology continues to mature.