Crypto: On-chain Attacks Increase 420% Due to State Hackers Chainalysis Claims that

While everyone is watching the crypto prices, state hackers are meticulously hiding their hacking instructions directly in the blockchain. According to a Chainalysis report published on September 17, the number of times attackers stored malicious instructions or infrastructure information on public blockchains has surged by 420% in twelve months! And as if by chance, state actors like North Korea and Iran are leading the charge.

Crypto: A North Korean Group Switches Blockchains Three Times Before Delivering Its Malware

Chainalysis managed to link an activity previously unattributed, spread over Tron, Aptos, and BNB Smart Chain, to UNC5342. This is a North Korean group monitored by Google Threat Intelligence. The modus operandi is almost elegant but twisted:

• Pointers encoded in Tron and Aptos crypto transactions redirect infected devices to the same BSC transaction;
• Tron then serves as the main route, Aptos as backup if the first fails;
• This BSC transaction contains encrypted server addresses and configuration data. These link the compromised machines to an offchain infrastructure dedicated to remote access and data theft.

Everything can go wrong on a blockchain, except the instructions. And that’s why they remain accessible as long as the chain runs. It is the same principle as EtherHiding used by North Korean hackers in 2025 to hide crypto-stealing code in smart contracts. This is called a “dead drop” digital. For those who recall, Cold War spies hid microfilms under public benches; these actors hide their server addresses in a Tron transaction costing just $0.001.

Chinese AI in the Loop and Tehran Occupying Satoshi’s Bitcoin Address

Chainalysis goes further as malicious writings have jumped 440% since July 2025, when high-capacity open-source Chinese AI models became capable of producing malicious code with few safeguards. Eric Jardine, head of cybercrime research at Chainalysis, talks about a “clear temporal association”. All this while acknowledging the impossibility of proving that the authors of these crypto transactions actually used these AI models to industrialize their production. A grounded way of saying there is no evidence despite suspicions.

On the Iranian side, the story is almost stranger because actors suspected to be linked to the Iranian Ministry of Intelligence write “command-and-control” routing data directly onto the Bitcoin blockchain. And for their public rendezvous point, they chose an address historically linked to Satoshi Nakamoto. Without any real link to the attackers, it just serves as a public marker that all infected devices can check. Then it is enough to publish a new Bitcoin transaction to change infrastructure. Infected machines automatically retrieve new crypto instructions, then the operation moves offchain for remote access, credential theft, or delivering other malicious payloads.

Wall Street Predicts $500,000 for Bitcoin by 2030

There is something quite amusing about the timing. Because at the very moment Chainalysis documents how state intelligence services transform bitcoin and public blockchains into sustainable spying infrastructure, Ric Edelman, founder of an asset management firm weighing $337 billion, predicts live on X that bitcoin will reach $500,000 by 2030! Adding that his forecast is actually quite conservative compared to many others.

Two narratives for a single blockchain. On one side, the technical layer serving as PLC for North Korean and Iranian hackers. On the other, the narrative layer selling a seven-figure dream. Both run on the same crypto network, at the same time, and that’s the real issue. The infrastructure that carries the valuation is also exploited by states for spying. A detail Twitter threads on the next BTC ATH systematically forget to mention.

What to Retain from On-chain Attacks Orchestrated by State-Linked Crypto Hackers?

• Malicious on-chain attacks have grown 420% in one year, with state actors accounting for 51% of activity in Q2 2026, up from less than 10% a year earlier.
• North Korea (UNC5342) routes its instructions via Tron, Aptos, then BNB Smart Chain to blur tracks before connecting to its offchain infrastructure.
• Iran is suspected of using bitcoin and an address linked to Satoshi Nakamoto as a public marker to update its attack instructions.
• The 440% increase in malicious attacks since July 2025 coincides with the rise of open-source Chinese AI models.

Originally, the blockchain was designed to be tamper-proof and permanent. Two qualities appreciated by both supporters of the “number go up” and North Korean and Iranian state intelligence services alike. No one really anticipated this second audience but amidst it all, bitcoin now has a target of $500,000.