State-linked hackers accounted for roughly two-thirds of new malware activity each quarter as the number of times attackers stored malware instructions or infrastructure information on public blockchains rose 420% over the past 12 months, according to a Chainalysis report.
Chainalysis identified North Korea and Iran-linked operators among the state actors adopting the technique. The analytics firm connected previously unattributed activity spanning Tron, Aptos and BNB Smart Chain to UNC5342, a North Korea-linked group tracked by Google Threat Intelligence.
Encoded pointers in Tron and Aptos transactions directed infected devices to the same BSC transaction, with Tron serving as the first route and Aptos as a fallback. The BSC transaction contained encrypted server addresses and configuration data that connected compromised devices to offchain infrastructure used for remote access and data theft.
Using public blockchains increases the durability of malware campaigns because stored information remains accessible after domains, servers or code repositories are taken down. In 2025, North Korean hackers used a similar technique called EtherHiding to place crypto-stealing code in smart contracts.
Chainalysis also recorded a 440% increase in malicious blockchain writes since July 2025, when high-capacity open-source Chinese artificial intelligence models became capable of producing malicious code with limited safeguards. Eric Jardine, cybercrimes research lead at Chainalysis, stated the company found a "clear point-in-time association" but could not prove that actors publishing the malicious transactions had used the models to increase their output.
Iran-Linked Actors Target Bitcoin Blockchain
Chainalysis identified threat actors it suspects are linked to Iran's Ministry of Intelligence writing encoded command-and-control routing data onto the Bitcoin blockchain. The company based its assessment on the malware family, decoding method, timing and server infrastructure associated with previously reported Iranian operations.
Attacker-controlled wallets sent small payments to a well-known Bitcoin address with historical ties to Bitcoin creator Satoshi Nakamoto. Chainalysis said the address had no connection to the attackers and served as a permanent public location that infected devices could check for updated directions.
The attackers could change their server infrastructure by publishing another Bitcoin transaction, after which infected devices would automatically retrieve the new information. Once the malware obtained those instructions, the operation moved offchain for activities that could include remote access, credential theft and the delivery of additional malware.
