Abstract The complexity of network security has grown, and new problems have emerged that call for more sophisticated network security solutions. Due to their historical reputation as rigid and unscalable systems, intrusion detection systems (IDSs) require innovation. This research proposes a distributed intrusion detection framework that integrates blockchain technology with Multi-Agent Reinforcement Learning (MARL) for enhanced blockchain security, transparency, and decentralization. The proposed system was trained and tested over the Open, Public, and Network Traffic Dataset of Internet of Things (TON-IoT) to detect cyber threats in a resilient manner over IoT networks. Blockchain guarantees the integrity of data, while the IDS is MARL, which can learn active, unprecedented, and evolving attack patterns. Experiments have shown that the proposed approach achieves 99.99% accuracy on the TON-IoT dataset, outperforming standard IDS approaches. Further, the usage of the framework is validated for generalization by comparing the datasets of the Botnet Dataset for Internet of Things (BOT-IoT) dataset with 99.65% accuracy. To improve performance, a large ablation experiment was conducted to attempt to identify the required learning parameters (reward form, exploration-exploitation dilemma, and learning rate decay). To reduce the false positives, a balanced performance reward scheme was introduced, reducing the accuracy to 95.67%. For stable decision-making, the investigation rate was set to a constant 0.1. In experiments on learning information, we demonstrate that 0.001 is a reasonable compromise between convergence rate and stability. This is well exemplified by the fact that IDS can secure both systems by using MARL and Blockchain. Future work will then focus on real-time dynamicity, reducing computational overhead, and expanding the model to various network environments. This research establishes an emerging practice of intelligent distributed intrusion detection in emerging cybersecurity architectures. Data availability The dataset is available on reasonable request. Abbreviations - IDS: - Intrusion Detection Systems - PPO: -