AI Fuels 440% Surge in Hackers Using Blockchains to Aid Attacks

Open-source artificial intelligence is making it easier for hackers to hide malicious code on blockchains, opening a new front in a crypto industry already grappling with rising cybercrime.

Instances of malware instructions written into on-chain transactions and smart contracts are up 440% in less than a year, averaging 11 cases per day, blockchain analytics firm Chainalysis said in a report published on Thursday. Such cases averaged two per day prior to the release in the middle of last year of powerful Chinese open-source AI models with no restrictions on generating malicious code, according to the report.

A malware attack uses malicious software planted on a computer or network to steal information, passwords or funds. In the attacks documented by the report, hackers use a blockchain to leave instructions for that software, telling it where to send information, a technique known as “blockchain dead drop”. This can make an attack harder to stop because information recorded on a blockchain cannot be easily removed.

State-backed groups — including those linked to North Korea and Iran — now account for the majority of this activity, the report said.

The findings add to evidence of generative AI contributing to a boom in cyber threats, by spotting more software vulnerabilities and allowing cybercriminals to carry out more attacks. In crypto, the number of hacks rose roughly 150% to 207 in the first half of the year, according to blockchain intelligence firm TRM Labs.

Blockchains are typically not involved in the initial infection of a machine, which often happens through conventional means such as supply-chain attacks or malicious downloads, Eric Jardine, head of research at Chainalysis, said in response to questions over email. The firm has not tracked how many attacks were successful, or how much money was lost.

Hiding malware on a blockchain is not new, Chainalysis said, but powerful new open-source AI models are allowing hackers to carry out attacks on a larger scale, while growing involvement by state actors is making them more sophisticated.

Worsening the threat, open-source AI models can be run independently, allowing hackers to modify them or remove safeguards against cybercrime.

“This gives malicious developers greater control over the model and more privacy,” said Vitaly Kamluk, founder of cybersecurity consultancy TitanHex.

By contrast, companies such as OpenAI and Alphabet Inc.’s Google can block access to their AI services when they detect abuse.

The transparency of blockchains cuts both ways, though. Every update attackers post is permanently recorded, letting investigators map their infrastructure and connect campaigns that would otherwise look unrelated, according to Chainalysis.