Malicious instructions hidden inside blockchain transactions have surged nearly fivefold in less than a year, according to a new Chainalysis report published on September 17. The firm counted an average of 2.06 malicious writes a day a year ago; that figure now stands at 11.1.
The technique is a digital dead drop. Instead of relying on a command server that defenders can shut down, attackers bury instructions inside transactions or smart contracts. Nothing on a blockchain can be deleted or blocked, so an infected device just checks the same address over and over for fresh orders — where to send stolen data, or which server to switch to next.
Roughly two-thirds of this activity in the most recent quarter traces back to groups linked to North Korea and Iran. North Korean operators, tracked by Google Threat Intelligence under the name UNC5342, lean on Tron, Aptos and BNB Smart Chain. Suspected Iranian actors favor Bitcoin, sending tiny payments to an address historically associated with Satoshi Nakamoto to keep their infrastructure coordinates in one permanent place.
The spike lines up almost exactly with July 2025, when powerful open-weight Chinese AI models became widely available and capable of writing malicious code with few guardrails. Chainalysis researcher Eric Jardine is careful about the causal claim: the timing correlation is clear, he says, but there's no proof yet that the hackers behind these transactions actually used those specific models.
It's an awkward side effect of the exact feature that makes blockchains attractive in the first place. The permanence that protects ordinary users from censorship now also protects malware infrastructure that law enforcement has no real way to take down.
