Chainalysis: State-sponsored hackers behind half of blockchain-based malware

Chainalysis reported that malicious code written to public blockchains has increased fivefold over the past year, with state-backed actors responsible for approximately half of these incidents. Since mid-2025, daily malware instructions on-chain have risen from 2.06 to 11.1. Attackers are using 'blockchain dead drops,' embedding command server addresses into smart contracts or transactions to evade traditional blocking. The report highlights operations by North Korean groups using TRON, Aptos, and BNB Chain, as well as Iranian-linked actors utilizing Bitcoin transactions and Russian-language criminal groups operating on Polygon.