Chainalysis Maps Malware’s Use of Public Blockchains

Key Takeaways

• Chainalysis reported a 420% annual rise in activity involving onchain stores of malware instructions.
• Its September 17 report traced campaigns across five blockchains, including a relay spanning Tron, Aptos and BNB Smart Chain.

Details

Chainalysis said in a September 17, 2026 report that attackers are increasingly using public blockchains to keep malware operations running after conventional hosting is disrupted. It reported a 420% rise in the activity over the preceding 12 months.

The firm calls these systems blockchain dead drops. Infected devices retrieve instructions or server locations from transactions and smart contracts, then connect to attackers' infrastructure offchain.

In one case, Chainalysis linked a three-network relay to UNC5342, a North Korea-linked group tracked by Google Threat Intelligence. Tron and Aptos provided alternative routes to the same BNB Smart Chain transaction, giving the campaign a fallback if one route failed.

Google's October 2025 research had documented UNC5342 using blockchain data in fake-job-interview attacks on cryptocurrency developers. Google also found that the operators relied on centralized services to retrieve that data, and said some providers took action after being contacted.

Market Analysis

For crypto businesses, the findings put malware infrastructure alongside stolen-fund movements as an area for blockchain monitoring. The two research accounts also show where disruption remains possible: persistent onchain records coexist with service providers that can block malicious access. Connecting those records with activity on infected devices gives security teams a fuller view of how a campaign survives changes to its servers.

Note: This article is for news reporting only and does not constitute investment advice.