Chainalysis reports 420% surge in onchain malware linked to state hackers

State-sponsored hackers aren’t just stealing crypto anymore. They’re building their attack infrastructure directly on top of it. Chainalysis’s 2026 Crypto Crime Report reveals that North Korea-linked threat actors have begun using public blockchains to host malware payloads and command-and-control instructions. Separately, suspected Iran-linked actors have been embedding operational commands directly into Bitcoin transactions, using the network’s immutability as a feature rather than a bug. The numbers behind the threat North Korean cyber groups stole approximately $2 billion in digital assets over 2025, a 51% increase compared to the prior year. The single largest contributor was the $1.5 billion Bybit exploit. Cumulative theft attributed to North Korea, as tracked by Chainalysis, now exceeds $6.75 billion. Total illicit cryptocurrency flows reached at least $154 billion in 2025, a 162% year-over-year increase. Sanctioned entities received at least $104 billion in on-chain transactions, up 694% from the previous year. Stablecoins dominated that illicit volume, with Russia’s A7A5 token alone processing over $93 billion. Blockchains as malware infrastructure North Korea-linked group...