Iran-linked malware takes its orders from a Bitcoin address once tied to Satoshi
Chainalysis logged a 420% rise in onchain malware writes for its 2026 crime report, and says suspected Iranian operators ran their update channel through a permanent public Bitcoin address nobody can take offline.
The Investor · Invest desk
What happened
- Chainalysis's 2026 Crypto Crime Report records a 420% surge in onchain malware linked to state-sponsored hackers.
- North Korea-linked groups have been hosting malware payloads and command-and-control instructions on public chains including Tron, Aptos and BNB Chain, the firm says.
- Chainalysis also identified actors it suspects are linked to Iran's Ministry of Intelligence writing encoded command-and-control routing data onto the Bitcoin blockchain.
- North Korean cyber groups stole approximately $2 billion in digital assets over 2025, a 51% increase on the prior year, according to the report.
- Total illicit cryptocurrency flows reached at least $154 billion in 2025, a 162% rise, with sanctioned entities receiving at least $104 billion of on-chain transactions.
Why it matters
- What it limits constraint Seizing a server and revoking a domain, the two standard answers to a command-and-control host, do not reach instructions already written to an immutable ledger, so the response falls back on the infected machine.
- What it costs cost Crypto Briefing argues screening will have to cover what a transaction contains, on top of who sits on either end of it, and exchange compliance budgets are where that lands.
- Who's exposed exposure Stablecoin bills are moving through Congress with a $93 billion single-token figure now on the record, and issuers are the parties any freeze or screening duty would reach.
Next story · Invest · yesterday
Transfers above $10 million put the US back as a net bitcoin importer, Chainalysis findsConfirmed2 publishers
The hosting bill for the Iranian channel, on the account Chainalysis gave Cointelegraph, was a few small Bitcoin payments from attacker-controlled wallets to a well-known address with historical ties to Satoshi Nakamoto. The firm said that address had no connection to the attackers and simply sat there as a permanent public place for infected devices to check for updated directions [15]. Moving to new servers takes one more published transaction, after which the infected devices retrieve the new information themselves [16]. Everything after that happens offchain: remote access, credential theft, delivery of further malware [17].
The losses are still theft, and they concentrate hard. Chainalysis tracks cumulative North Korean theft above $6.75 billion [9], so last year is roughly three-tenths of the whole attributed history [19] and about $4.75 billion sits across all the years before it [24]. The Bybit exploit accounted for $1.5 billion of 2025 [8], which is 75% of the year and leaves about $500 million for everything else [20].
Set against total illicit flows of at least $154 billion [10], North Korea's take is about 1.3% [21]. Russia's A7A5 stablecoin alone processed over $93 billion [12], or close to 60% of the entire illicit total [22]. Sanctioned entities received at least $104 billion onchain, up 694% [11]; a 694% rise puts the prior-year base near $13 billion [23].
What Chainalysis has on artificial intelligence is timing. The firm recorded a 440% increase in malicious blockchain writes since July 2025, when it says high-capacity open-source Chinese models became capable of producing malicious code with limited safeguards [3]. Eric Jardine, the firm's cybercrimes research lead, told Cointelegraph they found a "clear point-in-time association." They could not prove that the actors publishing the malicious transactions and contracts had used the models to increase their output [13]. The Iranian attribution, Chainalysis said, rested on malware family, decoding method, timing and server infrastructure tied to previously reported Iranian operations, not on the blockchain activity alone [14].
Both reports give the percentages and leave out the absolute number of malicious writes behind them [18]. That decides what the 420% is worth: on a base of several hundred writes it is a few thousand transactions, and on a base of twenty it is a hundred. On the evidence published so far the large sums sit in the theft figures, and the onchain tooling finding is a detection cost handed to whoever has to spot a lookup that Chainalysis says network monitors watching for conventional communication patterns will not flag [5]. If the firm publishes write counts in the thousands, that reading is wrong.
What to watch
- Whether Chainalysis publishes the absolute write counts underlying the 420% and 440% figures.
- Whether the stablecoin bills moving through Congress attach screening or freeze duties to issuers after the $93bn A7A5 number.
- Whether any large exchange starts screening transaction contents for embedded instructions and discloses what it costs.
Information, not investment advice. This story is general information about companies and markets, drawn from cited reporting. It is not a recommendation to buy, sell or hold any security; check the cited sources before acting.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence52
- Adoption45
- Hype gap+30
- Incentives68
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Chainalysis's 2026 Crypto Crime Report reports a 420% surge in onchain malware linked to state hackers.
- [2]
Data stored on a blockchain is immutable and censorship-resistant by design; once malware instructions are embedded in a transaction, no single entity can take them down, and there is no server to seize and no domain to revoke.
- [3]
Chainalysis recorded a 440% increase in malicious blockchain writes since July 2025, when it said high-capacity open-source Chinese artificial intelligence models became capable of producing malicious code with limited safeguards.
- [4]
Chainalysis identified threat actors it suspects are linked to Iran's Ministry of Intelligence writing encoded command-and-control routing data onto the Bitcoin blockchain.
- [5]
Because Bitcoin's ledger is permanent and publicly accessible, embedded commands can be read by malware agents anywhere in the world without raising suspicion from network monitors looking for traditional communication patterns.
- [6]
North Korea-linked groups have been deploying malware payloads and command-and-control instructions on public blockchains including Tron, Aptos and BNB Chain, according to Chainalysis.
- [7]
North Korean cyber groups stole approximately $2 billion in digital assets over 2025, a 51% increase compared with the prior year, according to Chainalysis.
- [8]
The single largest contributor to 2025 North Korean crypto theft was the $1.5 billion Bybit exploit.
- [9]
Cumulative theft attributed to North Korea, as tracked by Chainalysis, now exceeds $6.75 billion.
- [10]
Total illicit cryptocurrency flows reached at least $154 billion in 2025, a 162% year-over-year increase.
- [11]
Sanctioned entities received at least $104 billion in on-chain transactions in 2025, up 694% from the previous year.
- [12]
Stablecoins dominated illicit cryptocurrency volume in 2025, with Russia's A7A5 token alone processing over $93 billion.
- [13]
Eric Jardine, cybercrimes research lead at Chainalysis, told Cointelegraph that they found a "clear point-in-time association," but could not prove that the actors publishing the malicious transactions and contracts had used the models to increase their output.
- [14]
Chainalysis said its Iranian assessment was based on the malware family, decoding method, timing and server infrastructure associated with previously reported Iranian operations, rather than the blockchain activity alone.
- [15]
Attacker-controlled wallets sent small payments to a well-known Bitcoin address with historical ties to Bitcoin creator Satoshi Nakamoto; Chainalysis said the address had no connection to the attackers and served as a permanent public location that infected devices could check for updated directions.
- [16]
The attackers could change their server infrastructure by publishing another Bitcoin transaction, after which infected devices would automatically retrieve the new information.
- [17]
Once the malware obtained those instructions, the operation moved offchain for activities that could include remote access, credential theft and the delivery of additional malware.
- [18]
No absolute count of malicious blockchain writes is stated alongside the 420% and 440% figures in the two reports.
- [19]
The approximately $2 billion stolen in 2025 is about 30% of the more than $6.75 billion cumulative total attributed to North Korea.
- [20]
The $1.5 billion Bybit exploit is 75% of North Korea's approximately $2 billion 2025 total, leaving about $500 million from all other activity.
- [21]
North Korea's approximately $2 billion is about 1.3% of the at least $154 billion of total illicit flows in 2025.
- [22]
The over $93 billion processed by Russia's A7A5 token is close to 60% of the at least $154 billion total illicit flow figure.
- [23]
A 694% increase to at least $104 billion implies a prior-year base of roughly $13 billion in sanctioned-entity receipts.
- [24]
Excluding 2025, about $4.75 billion of cumulative North Korean theft falls in earlier years.
- [25]
Crypto Briefing's assessment: for exchanges and digital asset platforms, compliance teams will need to screen not just for sanctioned addresses but for transactions that might contain embedded malware instructions.
- [26]
US lawmakers are actively working on stablecoin legislation, with multiple bills advancing through Congress.
Sources
2 independent publishers whose own reporting we read for this story.
- cointelegraph.comState hackers drive 420% surge in onchain malware, Chainalysis finds
1 article · September 17, 2026
- cryptobriefing.comChainalysis reports 420% surge in onchain malware linked to state hackers
1 article · September 17, 2026
Topics and entities
Topics
- Illicit Crypto Flow Measurement
- Stablecoin Regulation
- Blockchain Analytics and Forensics
- Onchain command and control
- State-sponsored crypto theft
Entities
- Tron
- Satoshi Nakamoto
- Bybit
- North Korea
- A7A5
- Chainalysis Crypto Crime Report
- Chainalysis
- Aptos
- Tether
- BNB Chain
- Iran's Ministry of Intelligence
- Bitcoin
- Eric Jardine