Open-Weight AI Abuse Spreads as On-Chain Malware Surges 440%

Open-weight artificial intelligence (AI) models are being exploited to inject malicious commands into blockchains, according to a recent report. Blockchain analytics firm Chainalysis reported that on-chain cyberattacks leveraging open-weight AI models have rapidly increased, with an average of 11 daily incidents compared to two per day a year ago—a 440% rise.

Attackers use open-weight AI to create malicious code or manipulated smart contracts, which they then deploy on the blockchain. They trick victims into interacting with these contracts to steal virtual assets or account information. On-chain transactions refer to recorded blockchain activity like Bitcoin (BTC) and Ethereum (ETH), while smart contracts are self-executing programs based on predefined conditions.

Chainalysis noted a clear rise in such attacks since mid-2023, when Chinese open-weight AI models were publicly released. Some models lack safety features to block malicious code requests or allow users to disable them. Unlike closed AI systems like ChatGPT and Claude, which operators control to block harmful requests, open-weight models let users run them locally on their computers, making it easier for developers to weaken or remove security measures without external oversight.

Attackers also employ a technique known as 'blockchain dead drops,' where malicious programs send stolen information or additional commands via the blockchain. Since data on the blockchain is hard to delete or alter, blocking attack infrastructure becomes difficult. The report highlighted that state-sponsored hacking groups linked to North Korea and Iran account for a significant portion of these attacks.

Overall cyberattacks targeting virtual assets are also rising. Blockchain analytics firm TRM Labs reported 207 virtual asset hacks in the first half of this year, up about 150% from the same period last year. Chainalysis research lead Eric Zadine explained that blockchain-based infections often combine with traditional methods like supply chain attacks or malicious file downloads.

Chainalysis concluded that open-weight AI is being used by hackers to scale and refine their attack methods. Vitali Kamuk, founder of cybersecurity consultancy TitanHeks, stated: 'Open-weight AI provides malicious developers with control over the model and a high level of anonymity.'