Open-source AI models enable surge in blockchain-based malware attacks
Open-source AI models released in mid-2025 without safeguards have enabled hackers to increase malware attacks using blockchains by 440% in less than a year, with state-backed groups from North Korea and Iran reportedly leading the activity.
What happened
Instances of malware instructions written into on-chain transactions and smart contracts increased 440% in less than a year, averaging 11 cases per day, according to a report by blockchain analytics firm Chainalysis published on 17 September 2026.
The surge followed the release in mid-2025 of powerful Chinese open-source AI models with no restrictions on generating malicious code. Prior to their release, such cases averaged two per day.
Hackers use open-source AI models to hide malicious code on blockchains using a technique called 'blockchain dead drop', where malware instructions left on a blockchain tell software where to send stolen information or funds.
State-backed groups linked to North Korea and Iran now account for the majority of this activity, according to the Chainalysis report.
Reported impact
The number of crypto hacks rose roughly 150% to 207 in the first half of 2026, according to blockchain intelligence firm TRM Labs.
Open-source AI models can be run independently, allowing hackers to modify them or remove safeguards against cybercrime.
Index analysis
Hiding malware on a blockchain is not new, but powerful new open-source AI models are allowing hackers to carry out attacks on a larger scale with growing involvement by state actors making them more sophisticated.
The rise in blockchain-based malware represents a new front in the crypto industry's existing cybercrime problems.
Governance controls
Information recorded on a blockchain cannot be easily removed, making attacks harder to stop once malware instructions are deployed.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.