Attackers are increasingly hiding malware command-and-control data inside public blockchain transactions — a technique known as blockchain dead drops that has grown roughly 440% over the past year, according to a September 17 report from blockchain analytics firm Chainalysis. By embedding command-and-control (C2) data in public blockchain activity, the method allows attackers to rotate their infrastructure without having to reinfect victims.

Chainalysis notes that state-sponsored groups from North Korea and Iran now rank among the technique's most active adopters.

How Blockchain Dead Drops Work

Blockchain dead drops (BDD) rely on public blockchain transactions or smart contracts to store malware instructions and pointers to command-and-control (C2) infrastructure. The name is borrowed from espionage, where a "dead drop" is a location where information or supplies are left for another party to collect without any direct contact. Here, malware checks a public blockchain for hidden instructions rather than depending solely on a conventional C2 server.

Public blockchains suit this role because they are cheap to write to, readable by anyone, and difficult for any single party to take down. For malware operators, that means instructions and pointers planted on-chain stay retrievable by infected machines even as the rest of the infrastructure is swapped out.

Two approaches are most common:

• Transactions: Attackers conceal server addresses, malware links, or other instructions within blockchain transactions.
• Smart contracts: The same kind of information is stored in smart contracts, which can be updated whenever attackers move their infrastructure.

Once the malware retrieves what it needs, the attack moves off the blockchain. From that point, it may harvest passwords and cryptocurrency credentials or hand attackers remote control of the infected machine.

Security researchers have observed Iranian, North Korean, and Russian threat actors deploying these methods. Newer variations are also emerging, including schemes that hide a command server's IP address inside specially crafted blockchain wallet addresses.

Dead Drop Activity Is Accelerating

Malware operators have hidden commands on blockchains since at least 2013, but the tactic has expanded sharply in recent years. A turning point arrived in 2023 with EtherHiding, a technique in which attackers began concealing malicious code inside smart contracts.

Chainalysis researchers recorded daily malicious blockchain writes rising from 2.06 to 11.1 — a 440% jump in under a year. The metric tracks malicious data — server addresses, links, and instructions — that attackers have planted on-chain. The report links the growth to easier access to powerful AI tools, which have lowered the technical barrier for would-be attackers. Researchers are now tracking blockchain-based command systems across five major blockchains and more than a dozen malware strains.

State-Backed Hackers Take the Lead

When the technique first appeared, nearly all blockchain dead-drop activity traced back to cybercriminals. That began shifting in mid-2024, as state-linked groups entered the space.

According to Chainalysis, state-linked groups now account for roughly two-thirds of new blockchain dead drop activity each quarter, and about half of all activity. Researchers say groups tied to North Korea, Iran, and Russia are building on techniques first pioneered by cybercriminals.

At that scale, blockchain dead drops have outgrown individual hacking campaigns. Hostile states and affiliated criminal groups are now using them as flexible infrastructure that can be updated, reused, and shared across multiple attacks.

Documented Cases

In 2025, hackers linked to North Korea used multiple blockchains to conceal instructions for malware aimed at cryptocurrency developers. Distributing instructions across several blockchains provided backup routes and made the operation harder to disrupt. The malware ultimately went after victims' crypto credentials.

Operators linked to Iran hid instructions inside Bitcoin transactions. The malware retrieves and decodes the hidden data to locate attackers' current servers — servers that can be swapped out without updating the malware itself.

Russian criminal groups, meanwhile, are using smart contracts on Polygon to run a malware-for-hire operation. A single operator can manage many contracts, allowing different criminal customers to share the same underlying infrastructure.

Detecting Blockchain Dead Drops

Public blockchains are inexpensive to use and difficult to shut down. Chainalysis argues that blocking blockchain traffic is not a practical defense, since doing so could disrupt legitimate crypto services while attackers would simply find another route in.

Instead, security teams can monitor blockchain transactions for indicators of malicious activity. Because blockchain records are public and resistant to tampering, they can also help investigators identify attackers and trace their infrastructure.