Hackers are hiding malware on blockchains, with AI driving a 440% surge in attacks

Cybercriminals are increasingly utilizing public blockchains to store malware instructions, creating resilient communication channels that bypass traditional server infrastructure. According to Chainalysis, malicious blockchain activity has surged by 440%, with daily entries jumping from 2.06 to 11.1 following the emergence of unrestricted AI models. These models lower the technical barrier for attackers, allowing less experienced operators to build complex, blockchain-backed malware infrastructure. State-linked groups, including those from North Korea and Iran, are leveraging networks like TRON, Aptos, and BNB Chain to maintain persistent control over compromised systems. Because blockchain data is distributed and immutable, these 'dead drops' are nearly impossible to remove without disrupting legitimate financial services. While defenders face significant challenges in blocking this traffic, experts note that the public nature of these ledgers provides investigators with valuable on-chain evidence to track sophisticated threat actors.