Chainalysis Reports Significant Increase in Onchain Malware Linked to State Hackers

Chainalysis has revealed a staggering 420% increase in onchain malware associated with state-sponsored hackers, particularly from North Korea and Iran. The 2026 Crypto Crime Report indicates that these cyber groups are now utilizing public blockchains such as Tron, Aptos, and BNB Chain to host malware payloads and command-and-control instructions, marking a shift in their operational tactics.

In 2025, North Korean cyber actors stole approximately $2 billion in digital assets, a 51% rise from the previous year, with the Bybit exploit alone accounting for $1.5 billion. Cumulatively, North Korea's thefts have surpassed $6.75 billion. The report also highlights that total illicit cryptocurrency flows reached at least $154 billion in 2025, a 162% increase year-over-year, with sanctioned entities receiving at least $104 billion in on-chain transactions, a staggering 694% jump from the prior year.

The use of blockchains for malware infrastructure is particularly concerning due to their immutable and censorship-resistant nature. Once malware instructions are embedded in a transaction, they cannot be easily removed, posing significant challenges for cybersecurity. Additionally, Iranian-linked actors have been found to embed operational commands directly within Bitcoin transactions, allowing them to communicate covertly without detection.

As stablecoins accounted for a significant portion of illicit cryptocurrency volumes in 2025, the findings come at a critical time as U.S. lawmakers are advancing stablecoin legislation. The report suggests that exchanges and digital asset platforms must enhance their compliance measures to screen for not only sanctioned addresses but also for transactions that may contain embedded malware instructions, highlighting the ongoing vulnerabilities in the digital asset space.

© 2026 KLEA News. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.

Source: KLEA News