MALWARE instructions hidden in blockchain transactions and smart contracts have surged 440 per cent in less than a year, opening a new front in cybercrime as hackers exploit powerful open-source artificial intelligence models to scale attacks, blockchain analytics firm Chainalysis said.
Such activity now averages 11 cases a day, up from about two a day before the release in mid-2025 of powerful Chinese open-source AI models that have few restrictions on generating malicious code, according to a report published by Chainalysis on Sept 17.
Bloomberg reported today that the technique involves using blockchains to store instructions for malware, such as the location of a server controlling the malicious software. Known as a “blockchain dead drop”, it can make attacks harder to disrupt because information recorded on a blockchain cannot easily be removed.
“When malware uses a blockchain to relay key information – for example, where to find its latest active command-and-control server – its attempts to reconnect with the attacker become much harder to block effectively,” said Vitaly Kamluk, founder of cybersecurity consultancy TitanHex.
State-backed groups, including those linked to North Korea and Iran, now account for the majority of the activity, Chainalysis said.
Blockchains can be particularly attractive to state-linked groups in countries where renting servers or paying for hosting can trigger security checks or create payment obstacles, Kamluk said.
The findings add to growing evidence that generative AI is contributing to a rise in cyber threats by helping attackers identify software vulnerabilities and carry out attacks at greater scale.
In the cryptocurrency sector, the number of hacks rose about 150 per cent to 207 in the first half of 2026, according to blockchain intelligence firm TRM Labs.
Blockchains are generally not involved in the initial infection of a device, which often occurs through conventional methods such as supply-chain attacks or malicious downloads, said Eric Jardine, head of research at Chainalysis.
The firm cannot determine from blockchain data how many attacks succeeded or how much money was stolen, he said.
The use of blockchains to hide malware instructions is not new, Chainalysis said, but new open-source AI models are allowing hackers to conduct such attacks on a larger scale, while increasing involvement by state actors is making them more sophisticated.
Open-source AI models can be run independently, allowing hackers to modify them or remove safeguards designed to prevent cybercrime.
“This gives malicious developers greater control over the model and more privacy, because they do not have to submit their source code to large cloud providers that may monitor their platforms for abuse,” Kamluk said.
By contrast, companies such as OpenAI and Alphabet’s Google can block access to their AI services when they detect abuse.
The transparency of blockchains, however, can also aid investigators.
Every update posted by attackers remains permanently recorded, allowing investigators to map their infrastructure and connect campaigns that might otherwise appear unrelated, Chainalysis said. - September 18, 2026
