State-Sponsored Hackers Build Attack Infrastructure on Public Blockchains

State-sponsored hackers have shifted their tactics in crypto theft, no longer just stealing assets but also building attack infrastructure on public blockchains. Chainalysis's 2026 Crypto Crime Report reveals that North Korea-linked threat actors are using public blockchains to host malware payloads and command-and-control instructions.

North Korean cyber groups stole approximately $2 billion in digital assets over 2025, a 51% increase compared to the prior year. The single largest contributor was the $1.5 billion Bybit exploit.

Cumulative theft attributed to North Korea now exceeds $6.75 billion. Total illicit cryptocurrency flows reached at least $154 billion in 2025, a 162% year-over-year increase. Sanctioned entities received at least $104 billion in on-chain transactions, up 694% from the previous year.