AI-driven malware attacks surge on blockchains

TLDR

AI assisted hackers are increasingly using public blockchains to hide and coordinate malware, creating a fast growing cyber threat for crypto users and networks.

1. Chainalysis reports roughly a 420% year on year surge in malware instructions stored on public blockchains, driven mainly by North Korea and Iran linked groups.
2. Powerful open source AI models coincide with a 440% jump in blockchain dead drop payloads and a rise in AI generated malware targeting wallets and crypto infrastructure.
3. Defenders are starting to use AI for code scanning and formal verification, but for now crypto users face higher risk from phishing, wallet stealers and compromised apps.

Deep Dive

1. Scale And Actors

Blockchain analytics firm Chainalysis found that storing malware instructions on public chains has risen about 420% over the past 12 months, with state linked hackers responsible for around two thirds of new activity each quarter, and attributes most of it to groups tied to North Korea and Iran on networks such as Tron, Aptos, BNB Chain and Bitcoin here.

Chainalysis also observed a 440% increase in malicious blockchain writes since mid 2025, closely following the release of high capacity Chinese open source AI models that can generate exploit code with few safeguards, although it cannot prove every actor is directly using those models.

TRM Labs separately reported a 150% rise in crypto hacks to 207 incidents in the first half of 2026, suggesting the broader crypto attack surface is expanding alongside this onchain malware infrastructure.

Confidence: high because these figures come from multiple specialist security firms and are consistent across independent reports.

2. How Malware Uses Blockchains

Attackers increasingly use blockchains as resilient backends for malware, a technique dubbed blockchain dead drop, where encrypted server addresses or configuration data are embedded in transactions or smart contracts so infected devices can fetch instructions that cannot easily be taken down.

Chainalysis has documented North Korea linked groups encoding pointers on Tron and Aptos that lead to a BNB Chain transaction containing command and control data, while suspected Iran linked operators embed routing information on the Bitcoin blockchain here.

A recent HBO Max Reddit account hijack used 108 malware ads that targeted crypto wallets and browser credentials, with clippers that silently replace copied addresses and fake wallet apps designed to steal recovery phrases, and even relied on Binance Smart Chain contracts to rotate malware domains here.

3. Defense And What To Watch

On the defensive side, Ethereum co founder Vitalik Buterin argues that AI can also strengthen cybersecurity, particularly through AI assisted formal verification that mathematically proves critical blockchain software satisfies defined security properties here.

Ethereums security team and firms like Anthropic already use AI agents to scan code and uncover vulnerabilities at scale, and there is a growing push to apply machine checked proofs across protocols, bridges and wallets rather than only to small modules.

For individual crypto users, the practical focus remains basic hygiene: treating AI themed tools and downloads with extra skepticism, avoiding running copied terminal commands, securing seed phrases offline, and favoring well audited wallets and services, while institutions will need continuous AI powered monitoring and stricter verification of smart contract and bridge logic.

Conclusion

AI is amplifying both the offensive and defensive sides of blockchain security, with state backed groups using chains as durable malware infrastructure while researchers use AI to find and fix flaws. For crypto users, the immediate risk comes from more sophisticated phishing and wallet stealing tools that quietly plug into onchain dead drops. The path forward is not panic, but accelerating formal verification, automated monitoring and everyday security habits so that blockchains remain trustworthy even as AI powered attacks scale.