# Hackers hide malware on blockchains using AI

> Malicious blockchain activity surged 440% as AI tools lower the technical barrier for less experienced attackers to build persistent malware infrastructure.
- Title: Hackers hide malware on blockchains using AI · TechRadar
- Summary: Malicious blockchain activity surged 440% as AI tools lower the technical barrier for less experienced attackers to build persistent malware infrastructure…
- Keywords: malware, blockchain, cybersecurity, artificial intelligence, north korea, chainalysis, cryptocurrency, technology, Hackers, hide, blockchains, using
- Source: TechRadar — https://techradar.com/pro/hackers-are-hiding-malware-on-blockchains-that-are-nearly-impossible-to-take-down-and-unrestricted-ai-models-have-pushed-these-attacks-up-440
- Published: 2026-09-21T22:40:00+00:00
- Read time: 1 min
- Topics: malware, blockchain, cybersecurity, artificial intelligence, north korea, chainalysis, cryptocurrency, technology
## Malware moves to blockchains
Hackers are hiding malware instructions inside public blockchains, creating communication channels that survive the removal of conventional servers controlled by hosting providers.
## Activity surges 440 percent
Chainalysis reports malicious blockchain activity increased 440 percent, with daily entries rising from 2.06 to 11.1 after newer AI systems emerged.
## How blockchain dead drops work
Blockchain dead drops use transaction data or smart contracts as lookup points, allowing infected computers to retrieve commands, addresses, or configuration information without relying on conventional servers.
## North Korea leads the way
A North Korean-linked operation associated with UNC5342 uses TRON and Aptos as alternate routes before retrieving encrypted instructions through the BNB Chain, switching networks when necessary.
## Other nations join in
Iranian actors suspected of links to the country's intelligence ministry have embedded encoded routing information inside Bitcoin transactions. Russian-speaking cybercriminals commercialized the technique using Polygon contracts.
## AI lowers the barrier
High-capacity Chinese open models placed fewer restrictions on malware development requests. AI tools reduce knowledge barriers by helping less experienced operators understand unfamiliar technologies and produce blockchain communication components.
## Defense proves difficult
Blocking blockchain traffic could disrupt legitimate wallets, decentralized applications, exchanges, and decentralized finance services used worldwide. Attackers further complicate disruption by operating their own blockchain nodes.
## Investigators find clues on chain
On-chain records left by attackers can serve as important clues to track them. Kwon Jun-hyeok, General Manager of Chainalysis Korea, says tracking these traces and identifying attackers through blockchain intelligence will become increasingly important.

> Tracking these traces and identifying attackers and related infrastructure through blockchain intelligence will become increasingly important in responding to new cyber threats.
## Key takeaway

Hackers are increasingly hiding malware instructions on blockchains, with activity up 440% since AI systems emerged, creating communication channels that survive server removal.