The collection of services, wallets, tokens, and routing patterns that make blockchain activity repeatable and scalable. In illicit contexts, this includes laundering services, proxy entities, and hosting providers that help actors move value, obscure origin, and maintain operational continuity.
Expanded Definition
On-chain infrastructure is the operational layer that makes blockchain activity repeatable at scale: wallets, signing workflows, token rails, routing patterns, custody arrangements, and the services that connect them. In lawful environments, it supports treasury operations, payments, settlement, and automation. In hostile environments, the same infrastructure can be repurposed through proxy entities, laundering services, and hosting providers that preserve continuity while obscuring provenance.
Definitions vary across vendors when the term is used in crypto security, compliance, and agentic AI governance. In NHI security, the important distinction is not the chain itself but the identity and execution layer surrounding it: who can sign, what can be routed, where secrets live, and how transaction paths are repeated without human review. That framing aligns closely with the NIST Cybersecurity Framework 2.0 emphasis on asset visibility and access governance. The most common misapplication is treating on-chain infrastructure as a pure blockchain issue, which occurs when teams ignore the identities, credentials, and hosting dependencies that actually enable the activity.
Examples and Use Cases
Implementing on-chain infrastructure rigorously often introduces operational friction, requiring organisations to balance transaction speed and automation against stronger identity controls, review, and traceability.
- A treasury bot uses a dedicated wallet, policy engine, and approval route to move funds only within pre-approved limits, reducing manual bottlenecks.
- A DeFi integration relies on segregated signing keys and monitored routing patterns so that contract interactions remain attributable and recoverable under incident response.
- A laundering network uses layered proxy entities, disposable hosting, and repeated wallet rotation to break provenance and sustain movement after takedowns.
- An infrastructure team reviews wallet activity alongside the identity posture described in the 2026 Infrastructure Identity Survey, because autonomous systems often inherit access that exceeds human norms.
- Analysts cross-reference exposed secrets and compromised keys with cases such as the DeepSeek breach to understand how leaked credentials can feed repeatable blockchain abuse.
For protocol-level context, teams often compare wallet and signing patterns with NIST Cybersecurity Framework 2.0 governance objectives and then map transaction controls to internal identity policy.
Why It Matters in NHI Security
On-chain infrastructure matters because it turns a single credential exposure into a durable operating capability. If an attacker gains a signing key, token, or privileged wallet path, the issue is no longer just access theft. It becomes a continuity problem involving funds movement, service impersonation, and repeated abuse across multiple chains or venues. That is why NHI defenders treat wallets and routing logic as part of the identity perimeter, not as isolated financial artifacts.
NHIMG research shows that 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, and 70% grant AI systems more access than they would give a human employee performing the same job. Those patterns matter here because blockchain workflows often inherit the same over-privileged, long-lived access model. The result is that compromise can persist even when one endpoint is remediated. Organisations typically encounter the operational cost only after funds have moved, at which point on-chain infrastructure becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 | On-chain wallets and signing keys are NHI assets that require strict lifecycle control. |
| NIST CSF 2.0 | PR.AC-1 | Identity and access control govern who can sign, route, and move on-chain value. |
| NIST Zero Trust (SP 800-207) | Zero trust principles apply to every transaction path and automation hop in the chain. | |
| NIST SP 800-63 | AAL2 | High-risk signing workflows need stronger authenticator assurance than basic shared secrets. |
| OWASP Agentic AI Top 10 | AGENT-04 | Autonomous agents can trigger on-chain actions that require bounded tool and credential use. |
Inventory wallets, keys, and routing authorities, then remove unused access and rotate high-risk credentials.
Related resources from NHI Mgmt Group
- What do security teams get wrong about on-chain crime infrastructure?
- What fails when autonomous exploit systems can chain steps across live infrastructure?
- How can security teams detect package supply chain attacks that hide their C2 infrastructure?
- Who is accountable when a supply chain worm uses stolen tokens to create infrastructure?
