Onchain attacks are accelerating fast, with new research from Chainalysis pointing to a sharp rise in malware activity across public blockchains. The firm reports a 420% increase in onchain malware this year and says state-linked hackers—especially groups tied to North Korea and Iran—are responsible for most of the jump.

Chainalysis also argues that public blockchains make malicious campaigns unusually resilient: even if domains, servers, or traditional code hosting are taken down, the data stored on-chain can remain accessible and usable for longer periods.

Key takeaways

• Chainalysis attributes the majority of this year’s 420% surge in onchain malware to state-linked hackers, particularly those linked to North Korea and Iran.
• State-linked activity accounts for about two-thirds of new onchain malware cases involving attackers posting malware instructions or infrastructure details.
• Chainalysis identified UNC5342, a North Korea-linked group, tying it to previously unattributed activity spanning Tron, Aptos, and BNB Smart Chain.
• Public blockchains can extend malware “lifespans” by keeping command-and-control or payload-related instructions available after off-chain infrastructure is removed.

State-linked activity drives the onchain malware spike

Chainalysis’ report centers on how attackers are increasingly using public blockchains not just to move funds, but to store malicious instructions and supporting infrastructure information. According to the firm, the result is a significantly larger volume of malware operations visible on-chain this year—up 420%—with state-linked actors responsible for most of the increase.

The analysis highlights that state-linked hackers represent roughly two-thirds of new onchain malware activity. In practical terms, this suggests that the most sophisticated and persistent malicious campaigns are becoming more integrated with blockchain-based execution and data storage rather than relying solely on conventional, easily disrupted infrastructure.

Chainalysis further points to UNC5342, a North Korea-linked group, connecting it to earlier unattributed activity across multiple ecosystems, including Tron, Aptos, and BNB Smart Chain. For investors and builders, cross-chain attribution matters because it implies reuse of tactics and tooling across networks rather than isolated incidents confined to one platform.

Why public blockchains can make malware harder to eliminate

One of Chainalysis’ most important arguments is that onchain storage changes the operational economics of malware. Unlike typical malware infrastructure—where a takedown can sever access to payload code, hosting, or instructions—information recorded on public ledgers can remain accessible even after external components are removed.

Chainalysis explains that this durability can extend the life of malware campaigns. If attackers store instructions or infrastructure-related data on-chain, defenders may be able to shut down servers or domains, but the underlying on-chain information may still be retrievable and exploitable depending on how the malware is designed.

The report draws a comparison to earlier behavior attributed to North Korean hackers. In 2025, these actors reportedly used a technique referred to as EtherHiding to place crypto-stealing code inside smart contracts—again leveraging the fact that smart contract deployments are difficult to “undo” once they are live.

Attribution across chains signals broader threat tooling

Chainalysis’ identification of UNC5342 across Tron, Aptos, and BNB Smart Chain emphasizes a trend security teams have increasingly observed: attackers are treating chains as interchangeable environments for distribution, execution, or storage of malicious components.

For users, that means the risk of onchain malware is not limited to a single network’s vulnerabilities. For exchanges, custody providers, and wallet developers, it raises the importance of monitoring not only for known malicious contracts or addresses, but also for patterns in how malware instructions are encoded, delivered, and referenced—especially when the “instructions” are stored directly on-chain.

While Chainalysis’ findings show a strong state-linked component, the broader takeaway is that attackers can scale by shifting to platforms where their prior experience or infrastructure can be adapted with minimal changes.

What to watch next in onchain defense

As Chainalysis reports more state-linked actors adopting onchain methods, the immediate focus for the market should be on faster detection of onchain malware patterns and more robust controls around smart contract interactions, data indexing, and monitoring of malicious instructions stored on-ledger.

Readers should watch for whether this 420% rise continues into subsequent reporting periods, and whether security firms further narrow attribution to specific groups and techniques—particularly those that allow malware logic to remain usable even after off-chain elements are disrupted.

AI-linked crypto tokens have added about 9.4% in market value over the past 24 hours as King Charles III has hosted executives from Nvidia, OpenAI, Anthropic and Google DeepMind for talks on artificial intelligence safety.

According to CoinGecko data, the artificial intelligence token category held a combined market capitalization of about $18.6 billion on Sep. 17, with 24-hour trading volume reaching $2.42 billion.

The sector’s 9.4% rise outpaced a 1.9% increase in the total cryptocurrency market, which stood at about $2.72 trillion. AI agents gained 6.6%, AI applications rose 6%, and decentralized finance projects using artificial intelligence added 8.1%.

NEAR Protocol led the large-cap names with a 20.8% gain to about $3.05. Artificial Superintelligence Alliance, formerly known by the FET ticker, advanced 11.7% to $0.1674, while Render climbed 10.2% to $1.42. Bittensor rose 6.9% to about $229.48.

NEAR leads the AI crypto token rally

NEAR’s advance followed a milestone involving its confidential transaction infrastructure. As crypto.news reported on Sep. 17, confidential total value locked on the network exceeded $70 million, triggering the first snapshot under its incentive program.

The snapshot set aside 333,333 milestone tokens for eligible users. To qualify, users must hold more than $100 in confidential balances and have an active swap history, while each wallet can receive no more than 2% of the distribution.

NEAR said the tokens would remain locked until the asset’s three-day volume-weighted average price reaches at least $3.33. Its Confidential Intents system supports private execution across more than 30 connected blockchains.

The network has linked Intents to infrastructure for autonomous agents that may need to make payments or move assets across several chains. In July, NEAR also introduced a staking-based payment tool that lets users lock NEAR to receive monthly computing credits for 43 AI models, including services from OpenAI, Anthropic, and Google.

For Bittensor, CoinGecko pointed to OpenRoboto, also known as Subnet 80, going live on Base through a ForeverMoney wrapper. The integration uses Chainlink’s Cross-Chain Interoperability Protocol and gives the subnet access to Coinbase’s Ethereum layer-2 network.

Project-level news also separates the strongest token moves from the royal meeting. The summit did not announce blockchain integrations, token purchases, funding for decentralized AI networks or direct support for any cryptocurrency.

King Charles asks AI companies to agree on safety principles

At Dumfries House in East Ayrshire, Scotland, Buckingham Palace said King Charles brought together technology executives, government officials and civil society representatives to discuss how AI should be developed and used.

The Ditchley Foundation organized the event with the King’s Trust, the King’s Foundation and the Sustainable Markets Initiative. UK artificial intelligence minister Kanishka Narayan also attended.

Delegates considered whether companies and governments could establish common principles for AI systems. Buckingham Palace described the meeting as a discussion about a possible framework but did not announce a signed agreement, binding commitment or regulatory plan.

Speaking before the talks, Charles called for safety to remain central to AI development and warned about the “existential dangers” of the technology reaching the wrong hands.

“The task before you is not merely to advance technology, but to ensure that it remains firmly in the service of humanity.”

Nvidia chief executive Jensen Huang called for “responsible optimism,” according to Reuters, and warned against releasing systems before they are ready. Huang did not support an industry-wide pause, favoring voluntary controls by individual companies instead.

Questions about who can verify automated decisions have also reached the crypto sector. In a recent interview on AI verification, RoboTech Frontier Hub founder Denis “Dan” Saklakov said blockchains could record model states, permissions, decision conditions and execution histories without placing the AI system itself onchain.

Saklakov also argued that systems making financial decisions should separate analysis from authority. His firm’s Meijin tool uses AI to monitor investments but relies on deterministic, auditable rules when managing exits, rather than letting a language model make an unrestricted decision to move funds.

Anthropic proposal raises pressure on frontier laboratories

The Scottish meeting followed a call from Anthropic CEO Dario Amodei to reduce the speed at which leading laboratories improve their most capable models. In his September essay, “We Must Pace the Frontier,” Amodei said companies should give outside evaluators continuing access to their development processes.

His three-step proposal covers embedded independent evaluators, coordination among companies in democratic countries and possible agreements between governments. Amodei said the proposal would not stop model training or technical progress but would give safety work more time to catch up with model capabilities.

One concern cited by Amodei was recursive self-improvement, in which AI systems increasingly contribute to the design and training of their successors. He also pointed to the security failure involving OpenAI agents and Hugging Face.

In an August incident report, OpenAI said internal research models bypassed controls meant to isolate them from the internet during cybersecurity evaluations in July. The agents accessed parts of OpenAI’s research infrastructure and systems belonging to Hugging Face.

According to OpenAI, the agents executed code on dozens of Hugging Face servers, obtained root access to one server and accessed limited private data. OpenAI said customer data, product availability and normal services were not affected.

Internal monitoring detected unusual credential activity on July 19, and investigators connected it to the Hugging Face breach the following day. OpenAI said it subsequently imposed tighter alignment requirements, placed new limits on internet access and created more isolated testing environments.

US investors face a split response to AI safety calls

For American investors, the debate has affected listed semiconductor companies more directly than crypto-linked investment products. Nvidia, AMD and Intel shares fell after Amodei published his proposal, with Nvidia dropping as much as 3%, AMD losing about 4% and Intel declining roughly 6%, according to the Los Angeles Times.

OpenAI CEO Sam Altman and xAI founder Elon Musk publicly supported coordinated work to reduce frontier-model risks, while industry leaders differed over whether formal restrictions should apply. OpenAI President Greg Brockman said any coordinated slowdown should focus on companies developing the most capable systems rather than open-source developers and hobbyists.

President Donald Trump rejected the warnings in several Truth Social posts. He called the idea of AI taking control a “hoax,” linked the warnings to the political left, and dismissed predictions that robots would enter cities and eliminate people.

State-linked hackers accounted for roughly two-thirds of new activity each quarter as the number of times attackers stored malware instructions or infrastructure information on public blockchains rose 420% over the past 12 months, according to a Chainalysis report. 

Chainalysis identified North Korea and Iran-linked operators among the state actors adopting the technique. In one of the report’s findings, the analytics firm connected previously unattributed activity spanning Tron, Aptos and BNB Smart Chain (BSC) to UNC5342, a North Korea-linked group tracked by Google Threat Intelligence. 

Encoded pointers in Tron and Aptos transactions directed infected devices to the same BSC transaction, with Tron serving as the first route and Aptos as a fallback, Chainalysis reported. The BSC transaction contained encrypted server addresses and configuration data that connected compromised devices to offchain infrastructure used for remote access and data theft. 

Chainalysis said using public blockchains increases the durability of malware campaigns because the stored information remains accessible after domains, servers or code repositories are taken down. In 2025, North Korean hackers used a similar technique called EtherHiding to place crypto-stealing code in smart contracts.

AI tools accelerate malicious writes

The company also recorded a 440% increase in malicious blockchain writes since July 2025, when it said high-capacity open-source Chinese artificial intelligence models became capable of producing malicious code with limited safeguards.

Eric Jardine, cybercrimes research lead at Chainalysis, told Cointelegraph that they found a “clear point-in-time association,” but could not prove that the actors publishing the malicious transactions and contracts had used the models to increase their output.  

Related: Iran eases currency rules to bypass US sanctions with crypto: Report

Iran-linked actors put malware directions on Bitcoin

Chainalysis also identified threat actors it suspects are linked to Iran’s Ministry of Intelligence writing encoded command-and-control routing data onto the Bitcoin blockchain. 

The company said its assessment was based on the malware family, decoding method, timing and server infrastructure associated with previously reported Iranian operations, rather than the blockchain activity alone.

Attacker-controlled wallets sent small payments to a well-known Bitcoin address with historical ties to Bitcoin creator Satoshi Nakamoto, according to the report. Chainalysis said the address had no connection to the attackers and served as a permanent public location that infected devices could check for updated directions.

The attackers could change their server infrastructure by publishing another Bitcoin transaction, after which infected devices would automatically retrieve the new information. Once the malware obtained those instructions, the operation moved offchain for activities that could include remote access, credential theft and the delivery of additional malware. 

Magazine: Revolut ID thefts highlight KYC’s dangers: Here’s how to fix it

Anne Imhof has introduced a new era of performance art with slow-moving, bass-pounding tableaux that captivate even today’s media-addled attention spans. The German artist had one of the most talked-about artistic projects of 2025 with Doom: House of Hope, her three-hour epic performance loosely based on Romeo and Juliet. The event, which cast Balenciaga models alongside professional ballet dancers, drew 9,000 visitors across its 10 dates at the Park Avenue Armory in New York City. Imhof’s angsty-cool aesthetic has made her a darling of fashion brands and European museum curators alike. In the past year, she also co-starred in Valentino’s Cruise 2026 fashion campaign and unveiled a monumental permanent public sculpture of a swimming pool outside the Serralves Museum of Contemporary Art in Porto, Portugal. In September, she will open her first solo show in Asia: a survey exhibition at Hong Kong’s Tai Kwun center, where signature works will be shown alongside a new performance in collaboration with the Hong Kong Ballet.

State hackers drive 420% surge in onchain malware, Chainalysis finds

North Korean and Iran linked hackers were responsible for the majority of the 420% increase this year in malware on public blockchains according to a Chainalysis report. 

State-linked hackers accounted for roughly two-thirds of new activity whereby attackers stored malware instructions or infrastructure information on public blockchains.

Chainalysis also identified UNC5342, a North Korea linked group, to previously unattributed activity spanning Tron, Aptos and BNB Smart Chain.

Chainalysis said using public blockchains increases the durability of malware campaigns because the stored information remains accessible after domains, servers or code repositories are taken down. In 2025, North Korean hackers used a similar technique called EtherHiding to place crypto-stealing code in smart contracts.

North Korea using foreign talent to help infiltrate US companies: Report

North Korea (DPRK) is now using remote workers from third countries, including Iran and Lebanon, to pass job interviews, after which the positions are taken over by North Korean operatives. The aim is infiltrate US companies and obtain money to fund its weapons programs, NBC reported.

KOREA

Polymarket users referred to prosecutors in South Korea: Report

South Korean police have referred 18 Polymarket users to prosecutors in an illegal gambling investigation that had identified 26 users in total by analyzing publicly available blockchain data.

The users had collectively wagered about 17.6 billion won (worth $12.7 million) on Polymarket, which does not collect users real names or verify identities.  

Authorities said that Polymarket transactions constitute illegal gambling under South Korea’s Criminal Act because users stake assets on outcomes that cannot be predicted with certainty. 

HONG KONG

Metaplanet cuts Series 10 stock pool by 41%, plans Hong Kong subsidiary

After last week’s controversy over a plan to hand over as much as 20% of its fully diluted shares to executives, Metaplanet has now slashed the Series 10 stock pool.

Metaplanet will reduce the number of potential shares underlying the rights from 319.464 million to 188.19 million, and reset the conversion ratio to the level it was before its September 2025 international share offering.

The change will extinguish more than $220 million in warrant value and increase the company’s Bitcoin per fully diluted share by about 8.8%, according to Metaplanet.

CLARITY act failure is an opportunity for Hong Kong to seize ‘critical strategic window’

The South China Morning Post says crypto industry insiders are urging Hong Kong policymakers to seize the opportunity opened up by the failure of the CLARITY vote in the US.

The delay has given Hong Kong a “critical strategic window” said Allen Ding, director of Bitfire Research. Shawn Yan, founder of Cregis Technology said the city should focus on “building infrastructure that can operate across regulatory boundaries, rather than waiting for any single jurisdiction to define the market for everyone.”

CoinEx to cease operation after 9 years

The Hong Kong founded exchange said falling trading volumes and liquidity during the bear market, along with rising regulatory and compliance costs, was responsible for the decision to shutter the business. Withdrawals remain open until Dec. 22.

INDIA

India launches tokenized bond pilot with $107M issued

India’s securities regulator and central bank have launched a tokenized corporate bond pilot, with three companies issuing a combined 10.25 billion rupees (about $107 million) through the new market infrastructure. 

The Securities and Exchange Board of India (SEBI) said Demat 2.0 allows corporate bonds to be issued and held as digital tokens on a distributed ledger owned by the country’s statutory depositories. The system connects to the Reserve Bank of India’s (RBI) wholesale central bank digital currency (CBDC) through its Unified Market Interface. 

Parliamentary committee wraps year long crypto review

India’s Parliamentary Standing Committee on Finance has completed its hearings on cryptocurrency policy. The government will respond next week before the committee prepares and submits its report.

India’s Enforcement Directorate to beef up crypto investigations

India’s Enforcement Directorate aims to finalize economic crime investigations within 18 months and is beefing up its ability to track crimes involving cryptocurrencies.

VIETNAM

Bitcoin Suisse becomes Bitcoin Vietnam?

Bitcoin Suisse plans to shift up to half of its Swiss jobs to Bratislava and Vietnam.

Founded in Zug in 2013, the company provides crypto trading, custody, staking and lending services. It will establish a new center in Vietnam to look after many of the back office and administrative roles.

Vietnam develops new crypto-asset monitoring mechanisms 

Vietnamese regulators are building a supervisory mechanism covering crypto asset service providers and investor transactions. It draws upon recommendations from the Financial Action Task Force (FATF).

Binance signs MOU to help develop Vietnam finance center

Binance, the world’s largest exchange, has signed an agreement to help develop the Vietnam International Finance Center in Ho Chi Minh City.

SINGAPORE

Singapore Exchange gets nod for US perps

Singapore Exchange has become the first major Asian TradFi exchange to get approval from the Commodities Futures Trading Commission to provide Bitcoin and Ethereum perpetual futures to US institutions.

Singapore’s High Court offers guidance for valuing crypto assets

A recent decision has provided a precedent for valuing crypto assets in claims that departs from the usual breach-date damage assessment principles according to law firm Reed Smith. “The court is unlikely to allow claimants to delay mitigation for years and then seek damages at a higher present-day market price,” it noted.

Six Malaysians jailed for crypto poker robbery

Six Malaysian men were sentenced in Singapore to hefty sentences up to 12 years and 11 months —plus 24 strokes of the cane — over a 2024 armed robbery involving crypto, cash, and luxury items.

THAILAND

Thailand SEC proposes 5 million baht daily stablecoin transfer cap

Thailand’s SEC has proposed new stablecoin regulations that would prohibit users from transferring more than 5 million baht per day, worth around $151,000.

MALAYSIA

Malaysia is one of the more crypto friendly Islamic nations

According to Fitch Ratings Malaysia is one of the most crypto curious Muslim majority nations, with the local Securities Commission declaring Bitcoin, Ethereum, Ripple, and Stellar sharia-compliant.