Chainalysis said malicious blockchain writes increased from 2.06 a day to 11.1 after high-capacity open-weight Chinese AI models emerged. According to NS3.AI, groups tied to North Korea and Iran accounted for roughly two-thirds of newly observed blockchain-dead-drop activity each quarter by the second quarter of 2026.

Chainalysis said the models lowered the expertise needed to build the infrastructure, but its measurement did not identify a single model or prove that AI alone caused the increase.