State-linked hackers are increasingly using public blockchains to keep malware connected to command infrastructure that conventional takedowns cannot easily disable.
Groups linked to North Korea and Iran accounted for about two-thirds of newly identified blockchain dead-drop activity in each quarter by the second quarter of 2026, according to Chainalysis. State-backed operators now make up roughly half of all activity tracked by the analytics firm, compared with a negligible proportion in early 2024.
A blockchain dead drop hides malware instructions, command-and-control addresses or pointers inside transactions and smart contracts. Infected devices can repeatedly check those public records for new instructions, allowing criminals to change servers without infecting victims again.
Chainalysis recorded a rise in malicious blockchain writes from 2.06 per day to 11.1 after the emergence of high-capacity open-weight artificial-intelligence models from China – a 440% increase in less than a year. The company said the models reduced the technical expertise needed to build such systems, although its data does not identify a specific model or prove that AI alone caused the growth.
The development creates an additional security problem for crypto companies, developers and businesses using public chains for legitimate purposes. Blocking an entire network could also affect wallets, decentralised-finance platforms and other services.
North Korean operators use several networks
Chainalysis linked the North Korea-associated group UNC5342 to a system using TRON and Aptos as backup routes into BNB Smart Chain. Encoded pointers on TRON and Aptos direct infected devices to malware instructions stored on BSC. The malware checks TRON first and moves to Aptos if that connection fails.
Attackers can change their off-chain infrastructure by publishing another transaction, after which already compromised machines automatically obtain the new location. Chainalysis said stopping the campaign would require simultaneous action across all three networks.
Google Threat Intelligence began tracking UNC5342 in February 2025. The group used blockchain-based malware delivery in fake-job campaigns targeting cryptocurrency and technology developers, employing smart contracts to distribute software designed to steal browser data, passwords and crypto wallets.
The method developed after traditional hosting providers began removing malicious infrastructure. EtherHiding campaigns emerged on EVM-compatible networks in 2023, moving code into smart contracts that remained accessible after websites and servers were taken down.
Iran-linked operators have used Bitcoin differently. Chainalysis said suspected actors connected to Iran’s Ministry of Intelligence placed command-and-control routing details in Bitcoin transactions sent to a well-known address historically associated with Satoshi Nakamoto. The address is not linked to the attackers but provides a permanent public reference for infected devices.
Smaller criminal groups adopt the technique
Chainalysis now tracks dead-drop activity on five major networks and across more than a dozen named malware strains. Russian-language criminal groups have used smart contracts on Polygon as command resolvers and marketed the infrastructure to other criminals as malware-as-a-service.
In one case, a main wallet controlled several resolver contracts, apparently supporting different customers or campaign versions. Associated addresses were also tied to fraudulent tokens and clipboard-hijacking operations targeting crypto users.
Using blockchains remains relatively cheap, while records are globally available and difficult to remove. Defenders can nevertheless monitor timestamped transactions, wallets, contracts, funding links and update histories. They can also inspect outbound JSON-RPC requests for suspicious queries to contracts or addresses.
Centralised API and RPC providers may therefore become key intervention points. Protocol developers have limited scope to remove the capability without restricting legitimate blockchain use, leaving exchanges, infrastructure companies and cybersecurity teams to track activity across several networks.
