State-backed hackers exploit onchain malware surges 420% in 2024

State-linked cybercriminal groups have driven a dramatic increase in onchain malware activity, with new attacks stored on public blockchains rising by 420% over the past year, according to Chainalysis. The surge reflects a strategic shift by actors—including those tied to North Korea and Iran—as they exploit blockchain’s permanence to persist beyond traditional infrastructure takedowns. In one notable case, Chainalysis traced previously unattributed malware campaigns across Tron, Aptos, and BNB Smart Chain to UNC5342, a North Korea-affiliated group. Infected devices received encoded commands via Tron and Aptos transactions, directing them to a BSC transaction containing encrypted server addresses and configuration data for remote access and data exfiltration. The technique mirrors past tactics like EtherHiding, where North Korean hackers embedded crypto-stealing code in smart contracts in 2025.