Malware attacks using public blockchains have jumped as AI tools make it easier for state-backed hackers to avoid takedowns. North Korea and Iran now lead this threat, forcing crypto companies and users to rethink security.
Malware campaigns are changing quickly. State-backed hackers are now hiding their command infrastructure inside public blockchains, making takedowns much harder. Chainalysis reports that groups linked to North Korea and Iran are behind most of these so-called blockchain dead drops. In this method, malware instructions are stored in blockchain transactions and smart contracts. Attackers can update their infrastructure at any time, avoiding traditional hosting shutdowns and keeping control over infected devices.
AI Lowers the Barrier
Artificial intelligence is driving this shift. After high-capacity Chinese AI models became available, Chainalysis saw the number of malicious blockchain writes jump from just over two per day to more than eleven-a 440% increase in less than a year. These AI tools make it easier for less skilled actors to build and maintain resilient malware infrastructure. Chainalysis notes that AI is not the only factor, but it has made these attacks harder to disrupt and more accessible to a wider range of attackers.
Chainalysis reported that the average number of malicious blockchain writes rose from about 2.06 per day to 11.1 per day over 12 months, marking a 420% increase.
North Korea and Iran Adapt Tactics
The North Korean-linked group UNC5342 shows how blockchain infrastructure can make malware campaigns more robust. Chainalysis traced the group's use of TRON and Aptos networks as backup entry points into BNB Smart Chain, with encoded pointers that direct infected devices to updated malware instructions. If one route fails, the malware switches to another. Attackers can rotate their off-chain servers by posting a new transaction. Disrupting these operations would require coordinated action across all three blockchains. Google Threat Intelligence began tracking UNC5342 in early 2025, noting its use of blockchain-based malware delivery in fake job campaigns targeting crypto and tech developers. At the same time, Iran-linked actors have embedded command-and-control data inside Bitcoin transactions sent to a well-known address associated with Satoshi Nakamoto, using it as a permanent public reference for infected machines.
Criminals and Malware-as-a-Service
This approach is not limited to state actors. Russian-language criminal groups have started using smart contracts on Polygon as command resolvers, offering this infrastructure to others through a malware-as-a-service model. Chainalysis identified a main wallet controlling several resolver contracts, each apparently serving different customers or campaign variants. Related addresses have also been linked to fraudulent tokens and clipboard-hijacking campaigns targeting crypto users. The economics are simple: posting small amounts of data on public chains is cheap, and the records are globally accessible and hard to remove. Attackers keep most of their infrastructure off-chain, using the blockchain mainly to direct infected devices to new servers.
The 'blockchain dead drop' method stores malware instructions or command-and-control configuration inside on-chain transactions and smart contracts, making takedowns harder because attackers can change infrastructure by posting new transactions instead of relying on a fixed server.
Defensive Challenges and Monitoring
For defenders, the permanence of blockchain records is a mixed blessing. Every transaction used to update malware infrastructure is timestamped and public, so security teams can map operator wallets, contracts, and funding links. Organizations can monitor outbound JSON-RPC requests-the calls software uses to query blockchain nodes-for signs of infected machines contacting suspicious contracts or addresses. Centralized API providers and RPC gateways may become the next focus, since their ability to spot and block malicious queries could determine how much of this new attacker resilience survives. But protocol-level changes to block arbitrary data writes could disrupt legitimate blockchain use, leaving exchanges, infrastructure providers, and cybersecurity firms with a growing monitoring burden.
Chainalysis now tracks blockchain-dead-drop activity across five major networks and more than a dozen named malware strains. By the second quarter of 2026, state-linked operators made up about half of all such activity, up from almost none in early 2024. North Korea and Iran together accounted for roughly two-thirds of new incidents each quarter. These trends echo patterns seen in other malware campaigns, such as those described in EgonCoin's recent coverage of address-swapping malware that persisted even after botnet takedowns.
Chainalysis data shows that malicious blockchain writes rose from 2.06 per day to 11.1 per day after advanced AI models appeared, a 440% increase in less than a year. By Q2 2026, state-linked groups were behind about half of all blockchain-dead-drop activity tracked by the firm, with North Korea and Iran responsible for roughly two-thirds of new incidents each quarter.
Storing malware instructions and command infrastructure on public blockchains changes the security landscape for crypto companies, developers, and users. Unlike traditional web infrastructure, blockchain records are globally distributed and nearly impossible to erase, making coordinated takedowns much more complex. This permanence gives attackers new resilience, but it also leaves a trail that defenders can analyze-if they have the resources and expertise. As AI tools keep lowering the technical barrier for building these systems, the burden on exchanges, infrastructure providers, and security teams will only grow. The next phase of this arms race will likely play out at the API and RPC gateway level, where the ability to filter malicious traffic without disrupting legitimate blockchain use could determine how much ground defenders can regain.
Storing malware instructions and command infrastructure on public blockchains is a form of "dead drop" communication. Attackers post encrypted or encoded data in transactions or smart contracts, and infected devices check these records for updates. This lets attackers change servers or instructions without needing to reinfect victims. Blocking this method is difficult without disrupting legitimate blockchain activity, and it highlights the trade-off between blockchain transparency and the risk of abuse. For users and companies, monitoring outbound blockchain queries and staying alert to new attack patterns is now a key part of crypto security.
