State-linked hackers are increasingly using public blockchains to maintain malware infrastructure that traditional security takedowns cannot easily disable, according to analysis by Chainalysis.
Groups tied to North Korea and Iran accounted for roughly two-thirds of newly observed blockchain dead-drop activity each quarter by the second quarter of 2026, with state-linked operators now representing about half of all activity tracked by the firm, up from a negligible share in early 2024.
The Blockchain Dead-Drop Technique
The technique stores malware instructions, command-and-control addresses, or pointers inside transactions and smart contracts. Compromised devices can repeatedly query these public records for updated instructions, allowing attackers to change servers without reinfecting victims.
Malicious blockchain writes rose from 2.06 per day to 11.1 per day after the emergence of high-capacity open-weight Chinese artificial-intelligence models—a 440% increase in less than a year. Chainalysis noted that these models lowered the expertise required to build the necessary infrastructure, though the firm did not identify a single model or establish that AI alone caused the increase.
Demonstrating Resilience Through Redundancy
North Korean-linked operators have demonstrated how blockchain infrastructure can make malware campaigns more resilient. Chainalysis connected the threat group UNC5342 to a setup that uses TRON and Aptos as redundant routes into BNB Smart Chain, with encoded pointers directing infected devices toward malware instructions. If one route fails, machines automatically switch to an alternative.
Google Threat Intelligence began tracking UNC5342 in February 2025 when it used blockchain-based malware delivery in fake-job campaigns targeting cryptocurrency and technology developers, employing smart contracts to deliver credential-stealing malware.
Iran-linked operators have taken a different approach, embedding command-and-control routing information inside Bitcoin transactions sent to a well-known address historically associated with Satoshi Nakamoto, which functions as a permanent public reference point for infected machines.
Expansion Beyond State Actors
The same techniques are spreading beyond state-backed groups as artificial-intelligence coding tools reduce the specialist knowledge required to build blockchain-based command infrastructure. Russian-language criminal groups have deployed smart contracts on Polygon as command resolvers, with infrastructure marketed through malware-as-a-service models.
This creates a path for attackers to rent blockchain-based infrastructure rather than design it themselves, lowering barriers to entry for smaller operators.
Security Challenges for Defenders
The permanence of blockchain records creates challenges for legitimate users and defenders alike. Blocking access to an entire network would disrupt wallets, decentralized-finance platforms, and other services relying on the same infrastructure.
However, the same permanence that gives attackers resilience leaves a timestamped record that cybersecurity teams can monitor. Every transaction used to rotate infrastructure remains publicly visible, allowing defenders to map operator wallets, resolver contracts, and funding relationships.
Organizations can monitor outbound JSON-RPC requests for signs that infected machines are contacting suspicious contracts or addresses. Centralized API providers and RPC gateways remain potential intervention points even when the underlying blockchain cannot be taken offline.
Protocol developers have limited options to remove the underlying capability without restricting legitimate blockchain use. That responsibility falls increasingly on exchanges, infrastructure providers, and cybersecurity firms to monitor activity across wallets, contracts, and multiple networks while preserving access for legitimate users.
