Malicious actors are increasingly using public blockchains to host malware instructions, and the emergence of unrestricted open-source artificial intelligence models has accelerated the trend, according to a recent report from blockchain analytics firm Chainalysis.

The firm found that harmful instructions written to blockchains increased by roughly 440% in less than a year, with the number of daily malicious on-chain writes rising from 2.06 to 11.1. The activity reflects a growing use of blockchains as infrastructure for communicating with compromised devices, rather than solely as systems for transferring digital assets.

The technique, which Chainalysis calls blockchain dead drops (BDDs), involves attackers placing malware payloads, instructions, or command information inside blockchain transactions or smart contracts. Infected devices can then retrieve the material when needed. The principal advantage for attackers is persistence: public blockchains can keep malicious command infrastructure accessible even after domains, servers, and online repositories have been taken down.

North Korea and Iran linked to much of the activity

Chainalysis said state-linked operators associated with North Korea and Iran account for much of the recent blockchain-based malware activity. The development marks an expansion of blockchain technology into a role that can support cyber operations by providing a resilient location for command-and-control information.

Traditional malware campaigns often depend on centralized servers to distribute instructions to infected computers. Those servers can be identified, seized, blocked, or taken offline by security teams and authorities. Public blockchains present a different challenge, because information recorded on-chain can remain available for extended periods and is distributed across networks rather than dependent on a single hosting provider.

The technique itself is not new. Chainalysis traced the concept back to 2013, when a variant of the Necurs botnet used Namecoin, a Bitcoin-derived blockchain, to store domain information. The method later expanded to Ethereum Virtual Machine-compatible networks. In 2023, it became more visible through an approach known as EtherHiding, which uses blockchain infrastructure to conceal malicious content. Security researchers subsequently linked that approach to North Korean activity, including campaigns involving fake job interviews.

AI lowers the technical barrier

Chainalysis identified mid-2025 as a major turning point in the growth of blockchain dead drops. The firm attributed the acceleration in part to the availability of powerful Chinese open-weight AI models capable of generating malicious code without the restrictions found in more tightly controlled systems.

Before such models became widely available, deploying blockchain-based malware infrastructure required greater technical expertise. According to the report, AI-assisted code generation lowered that barrier, allowing more operators to develop or modify malicious software and integrate it with blockchain-based communication mechanisms.

The key change, therefore, is not greater malware capability alone, but the easier creation and deployment of infrastructure that can survive conventional takedown efforts.

The development also illustrates how techniques initially associated with cryptocurrency networks can affect the wider cybersecurity ecosystem. Public ledgers, smart contracts, and decentralized infrastructure can give legitimate applications persistence and availability, but the same characteristics can be exploited by threat actors.

Activity extends beyond blockchain networks

The impact is no longer limited to blockchain users or cryptocurrency-related systems. Researchers at Netskope reported that the ChainDrop supply-chain attack affected more than 440 npm packages in August 2026, highlighting how blockchain-enabled malware techniques can intersect with mainstream software-development infrastructure.

For enterprises, the shift complicates conventional approaches to identifying and disrupting command-and-control systems. Blocking a malicious domain or removing a compromised server may not be sufficient when instructions are stored on a public ledger. Defenders may also need to examine how compromised systems retrieve data from blockchain networks, while distinguishing that activity from legitimate applications that use decentralized infrastructure.

For cybersecurity teams, the trend raises the importance of monitoring blockchain transactions, smart contracts, and other decentralized infrastructure alongside conventional domains, servers, and software repositories. The effectiveness of that monitoring will depend on detecting malicious use without treating all blockchain-related activity as hostile.

The findings underscore a broader challenge created by the combination of generative AI and decentralized technology. AI can reduce the expertise needed to build malicious tools, while blockchains can provide persistent infrastructure for distributing instructions, a combination that could make some cyber campaigns more difficult to disrupt.