Chainalysis reports a 440% rise in malicious blockchain writes, not successful attacks

Chainalysis says the average number of malicious writes it identified on public blockchains rose from 2.06 to 11.1 a day against its pre-open-model baseline. The company published the research on 17 September 2026. Its widely reported 440% figure describes observed on-chain activity, not a 440% increase in attacks that succeeded.

That distinction matters because a ledger can show how malware infrastructure is configured without revealing whether an attempted compromise reached a victim. Eric Jardine, Chainalysis head of research, told Bloomberg that blockchain data could not establish how many documented attacks succeeded or how much money was lost.

What the 440% figure measures

Chainalysis reported two related growth measurements with different baselines. It said overall blockchain dead-drop activity increased by 420% over the preceding 12 months. Separately, average malicious writes rose by 440% in less than a year when compared with the company’s pre-open-model baseline.

Neither percentage represents a matching rise in successful hacks. An on-chain write can add or update a payload reference, command configuration or pointer to other infrastructure. A ledger entry is therefore an observation about campaign infrastructure, not a confirmed victim, compromise or completed attack.

The company says it tracks the technique across five major blockchains, more than a dozen named malware strains and more than 15 campaigns or threat-actor clusters. The public report does not provide the complete dataset, classification rules, false-positive controls or detection-coverage history needed to reproduce its measurements independently. It also does not specify whether monitoring coverage or detection capacity changed during the comparison period.

How blockchain dead drops work

Chainalysis uses blockchain dead drop as an umbrella term for public-chain locations where attackers store malware payloads, command-and-control configurations or infrastructure pointers for later retrieval. The information can sit in transaction fields or smart-contract state, which malware on an already infected device can query.

The blockchain is generally not the initial infection route. Jardine told Bloomberg that attackers more often gain access through conventional methods such as malicious downloads or supply-chain attacks. After retrieval, the malware generally connects to off-chain infrastructure for subsequent activity.

The technique abuses legitimate blockchain functions. It does not depend on a disclosed flaw in blockchain consensus or cryptography. Its main security effect is to make post-compromise command infrastructure more durable and redundant. Information recorded on a public ledger is difficult to remove, but infected endpoints, blockchain access paths and off-chain servers remain possible points of intervention.

State-linked operators dominate new tracked activity

By the second quarter of 2026, state-linked groups produced roughly two-thirds of new blockchain dead-drop activity each quarter and half of total tracked activity, according to Chainalysis. Those shares apply only to activity identified in the company’s dataset, not to cyberattacks generally. They also depend on its campaign clustering and actor attribution.

In one case, Chainalysis linked DPRK-associated UNC5342 to a redundant route across several chains. It reported that TRON and Aptos transactions directed infected devices towards data on BNB Smart Chain. Chainalysis said the relevant deployer matched infrastructure previously attributed by Google Threat Intelligence Group, but the newly described cross-chain connection remains principally the company’s assessment.

Chainalysis also reported that suspected Iran-linked operators stored encoded command-and-control routing data in Bitcoin transactions. It said the suspected nexus rested on malware, decoding logic, timing and infrastructure rather than blockchain activity alone. In a separate case, it identified Russian-language criminal operators using Polygon smart contracts as resolvers in a malware-as-a-service operation, while saying those actors were not necessarily state-sponsored.

The evidence does not prove AI caused the increase

Chainalysis associates the growth with high-capacity Chinese open-weight AI models released in mid-2025, arguing that they lowered the technical barrier to building blockchain dead-drop infrastructure. That makes AI a proposed scaling factor in the company’s account, but the published evidence does not establish it as the cause of the entire increase.

The report does not identify a specific model used in a named campaign or publish prompts, generated code artefacts or other direct evidence of model use by a documented operator. This limitation does not show that Chainalysis holds no additional private evidence, but it prevents an independent campaign-level conclusion from the public material.

Durability also creates a defensive record

Permanent ledger entries have a two-sided effect. Attackers gain coordination points that are difficult to remove, while investigators gain timestamped traces that can help connect wallets, contracts and associated infrastructure. Permanent visibility does not guarantee rapid attribution, victim identification or successful disruption, particularly when the surrounding malware and off-chain systems remain obscure.

The durability does not make these campaigns impossible to disrupt. Initial delivery paths, infected endpoints, access to public blockchain services and off-chain command systems remain intervention points. Some on-chain records can remain accessible after surrounding infrastructure is disabled, so defenders need signals from more than one layer.

Chainalysis advises against blanket blocking of public blockchain traffic, which it says is not operationally feasible. Instead, it recommends combining blockchain intelligence with monitoring for unexpected outbound JSON-RPC calls, particularly from endpoints and servers with no legitimate reason to contact public blockchain services. Those connections can be correlated with information about malicious wallets, contracts, transactions and related off-chain infrastructure.

No Australia-specific victim or operation was identified in the reviewed material. The defensive relevance is broader for organisations whose systems can reach public blockchain services, including cryptocurrency businesses and software developers. Until success rates, victim counts and losses are known, on-chain traffic is best treated as a signal to investigate alongside endpoint and network evidence, not as proof by itself that a device is compromised.

One on-chain signal rarely answers every question about activity across endpoints and networks. The Hack Academy invites you to examine the underlying concepts through our online cybersecurity training programme, where self-paced learning pairs practical exercises with theory, and listed subjects include networking and cybersecurity fundamentals.