TL;DR: State‑linked hackers are exploiting public blockchains as durable dead‑drops for malware, sparking a 420% surge in on‑chain malicious payloads and hinting that AI tools may be turbo‑charging the threat.
The Details
Chainalysis reports that roughly two‑thirds of new on‑chain malware activity each quarter is tied to nation‑state actors, notably groups linked to North Korea and Iran. By embedding encoded pointers in transactions on Tron (TRX) and Aptos (APT) that resolve to a BNB Smart Chain (BNB) payload, attackers create a multi‑chain “dead‑drop” that survives takedowns of domains or servers. The BNB transaction holds encrypted server addresses and configuration data used to commandeer infected devices for data theft. The firm also notes a 440% jump in malicious blockchain writes since July 2025, coinciding with the emergence of high‑capacity Chinese AI models capable of generating malicious code. While the report flags a clear temporal link, it cannot definitively prove that the AI models were the direct cause of the increased output.
Watch For
- Regulatory or law‑enforcement crackdowns targeting the use of public blockchains for cyber‑crime, which could affect network usage patterns.
- Rapid development and adoption of on‑chain monitoring or “dead‑drop” detection tools that might mitigate the risk and restore confidence.
- Escalation of state‑sponsored campaigns that combine AI‑generated code with blockchain infrastructure, especially on lesser‑known networks like Tron, Aptos, and BNB Smart Chain.