Cybercriminals are embedding malware instructions directly into blockchain transactions, creating a channel that defenders cannot easily delete. Chainalysis, the blockchain analytics firm, has documented a sharp acceleration in the technique: malicious writes to public blockchains jumped from 2.06 per day in mid-2025 to 11.1 per day currently, a 440% increase in less than a year.

The method, known as a blockchain dead drop — a name borrowed from espionage, where a dead drop is a concealed location used to pass material between parties without direct contact — exploits the permanent nature of distributed ledgers. Rather than hosting command-and-control instructions on servers that law enforcement can seize or on domains that registrars can disable, attackers write encoded payloads or pointers into transaction data, smart contracts, or other on-chain fields. Infected machines then read the blockchain, decode the instructions, and carry out the actual attack — stealing credentials, gaining remote access, extracting data, or draining cryptocurrency wallets.

According to Chainalysis, the surge is directly attributable to the release of powerful open-weight AI models in mid-2025, which generated malicious code without restrictions. Open-weight models publish their parameters for anyone to download and run locally, outside the usage controls that hosted AI services enforce. Building a blockchain dead drop previously demanded deep expertise in malware development, smart-contract programming, and operational security. Cheap code generation lowered that barrier considerably, enabling less-skilled attackers to deploy the technique at scale.

A Technique That Has Grown Up

The blockchain dead drop is not new. Early examples appeared on Bitcoin-related systems, including a 2013 Necurs botnet variant that stored command-and-control domains on Namecoin. Later campaigns embedded data directly into Bitcoin transaction fields. EtherHiding, the smart-contract version most widely recognized today, emerged on Ethereum Virtual Machine chains in 2023 after operators such as ClearFake migrated malicious code to Binance Smart Chain when other hosting options faced regulatory pressure.

What has changed is the scope and sophistication. Chainalysis is now tracking activity across five major blockchains and more than a dozen named malware strains, with more than 15 distinct campaigns and threat-actor clusters employing blockchain dead drop techniques. That diversity indicates the tactic has moved from experimental testing by individual groups to repeatable tradecraft adopted across the criminal ecosystem.

Nation-State Actors Take the Lead

The shift in adoption patterns is particularly notable. According to Chainalysis, state-linked groups accounted for roughly two-thirds of new blockchain dead drop activity by the second quarter of 2026, and about half of total activity — a sign that governments have recognized the technique's advantages and folded it into their own operations.

North Korean attackers affiliated with a group tracked by Google's Threat Intelligence Group as UNC5342 have been using EtherHiding since February 2025. Their campaign, dubbed Contagious Interview, relies on fake recruiter outreach to target cryptocurrency and software developers, meaning a routine-looking job conversation can be the first step of an intrusion. After luring victims into running malicious files, the malware retrieves next-stage instructions from public blockchains, including BNB Smart Chain.

North Korean operators have hardened the attack by encoding pointers on multiple blockchains that resolve to the same location. In one variant, attackers placed encoded pointers on Tron and Aptos, both pointing to the same transaction on BNB Smart Chain. If one pointer is removed or blocked, the malware falls back to the alternative route, meaning a single takedown action cannot halt the operation.

Iran-linked operators are using a different variation. Chainalysis identified actors it suspects are tied to Iran's Ministry of Intelligence writing encoded command-and-control routing data into Bitcoin transactions in late 2024. Rather than relying on smart contracts, these operators embedded the useful data into small Bitcoin payments, with the malware knowing exactly where to look for instructions on the permanent ledger.

Why Blockchains Enable the Attack

The core problem is structural. Public blockchains are designed to be difficult to edit, and once data is written there is no conventional takedown button. Unlike hosting companies that can remove files or domain registrars that can revoke access, defenders cannot scrub the original on-chain entry. They can block surrounding infrastructure, monitor the wallets involved, and disrupt the next step, but the source material itself cannot be deleted.

That immutability — a property the blockchain industry markets as a strength — becomes a liability when criminals use it as infrastructure. Attackers benefit from the same characteristics that make blockchains attractive to legitimate users: transparency, permanence, and decentralization.

The Response Ahead

Chainalysis argues that protocol-level blocking, which would restrict what data can be written to public chains, would carry large and unacceptable tradeoffs. Instead, the firm recommends a more granular approach: map operator wallets, identify resolver contracts, trace funding trails, and monitor endpoints for suspicious calls to blockchain RPC services — the interfaces applications use to read data from a chain. The work is less satisfying than deleting an address book, but it reflects the defensive capabilities actually available.

The acceleration from 2.06 to 11.1 daily malicious writes demonstrates that once attackers find a working technique, adoption follows quickly. The question for blockchain defenders is whether endpoint monitoring and wallet tracking can scale fast enough to keep pace with the rising volume of attacks.

This article is based on reporting originally published by Blocktelegraph, with related coverage available via Startup Fortune.