Blockchain malware writes spike 440%, North Korea and Iran lead

Chainalysis reported that malicious writes to public blockchains rose from about 2.06 per day to 11.1 per day after the appearance of high-capacity open-weight Chinese AI models, a 440% increase over less than a year. By the second quarter of 2026, actors tied to North Korea and Iran accounted for roughly two-thirds of newly observed blockchain dead-drop operations each quarter.

The analytics firm defined the method as a blockchain dead drop: attackers embed malware instructions, command-and-control routing information or pointers inside public transactions and smart contracts. Compromised devices repeatedly query those public records for updated instructions, allowing operators to change back-end servers without reinfecting victims.

Chainalysis noted the rise followed the arrival of powerful open-weight AI models and found that those models lowered the technical barrier to building and operating on-chain infrastructure. The firm did not identify a single model and did not say AI was the sole cause of the increase.

One tracked group, linked to North Korea and labeled UNC5342, uses TRON and Aptos as redundant routes to reach malware instructions stored on BNB Smart Chain. Encoded pointers on TRON and Aptos direct infected machines toward the code on BNB Smart Chain; the malware queries TRON first and switches to Aptos if that route fails. Security teams began tracking UNC5342 in February 2025 after campaigns that delivered credential-stealing code via smart contracts in fake-job lures.

Actors connected to Iran have embedded routing information inside Bitcoin transactions sent to an address historically associated with Satoshi Nakamoto. That address is not owned by the attackers and serves as a permanent public reference point where infected machines can read routing data.

Chainalysis found the technique has spread beyond state-linked groups. The firm now tracks dead-drop activity across five major networks and more than a dozen named malware strains. Russian-language criminal groups have placed smart contracts on Polygon to act as command resolvers, and some operators offer blockchain-based infrastructure through malware-as-a-service models. Analysts identified wallets controlling multiple resolver contracts and linked related addresses to fraudulent tokens and clipboard-hijacking schemes targeting crypto users.

Economics help explain the adoption. Posting small amounts of data on public chains can be inexpensive, records are globally visible and hard to remove, and operators can keep most malicious components off-chain. When infrastructure needs to change, attackers can post a new on-chain pointer and infected machines will automatically fetch the updated location. Stopping an active campaign can require coordinated action across multiple chains.

The permanence of blockchain records also gives defenders a way to respond. Every transaction that rotates infrastructure is timestamped and visible, allowing analysts to map operator wallets, resolver contracts, funding flows and update histories. Monitoring outbound JSON-RPC requests, the calls software uses to query blockchain nodes, can reveal infected machines contacting suspicious contracts or addresses. Centralized API providers and RPC gateways remain points where intervention is possible even if a chain cannot be turned off.

Protocol developers face limited choices to prevent on-chain data writes without affecting legitimate uses. Chainalysis noted that preventing arbitrary data writes would require protocol changes with significant trade-offs. That leaves exchanges, infrastructure providers and cybersecurity teams to detect, trace and block malicious queries while preserving access for legitimate users.