State hackers drive 420% surge in onchain malware, Chainalysis finds

The company also recorded a 440% increase in malicious blockchain writes since July 2025, when it said high-capacity open-source Chinese artificial intelligence models became capable of producing malicious code with limited safeguards. Eric Jardine, cybercrimes research lead at Chainalysis, told Cointelegraph that they found a “clear point-in-time association,” but could not prove that the actors publishing the malicious transactions and contracts had used the models to increase their output. Related: Iran eases currency rules to bypass US sanctions with crypto: Report Chainalysis also identified threat actors it suspects are linked to Iran’s Ministry of Intelligence writing encoded command-and-control routing data onto the Bitcoin blockchain. The company said its assessment was based on the malware family, decoding method, timing and server infrastructure associated with previously reported Iranian operations, rather than the blockchain activity alone. Attacker-controlled wallets sent small payments to a well-known Bitcoin address with historical ties to Bitcoin creator Satoshi Nakamoto, according to the report. Chainalysis said the address had no connection to the attackers and served as a permanent public location that infected devices could check for updated directions. The attackers could change their server infrastructure by publishing another Bitcoin transaction, after which infected devices would automatically retrieve the new information. Once the malware obtained those instructions, the operation moved offchain for activities that could include remote access, credential theft and the delivery of additional malware. Magazine: Revolut ID thefts highlight KYC’s dangers: Here’s how to fix it