Chainalysis: Blockchain Dead Drops for Malware Surge 420% in a Year

Cybercriminals and state-sponsored hackers are increasingly storing malware instructions directly on public blockchains, a tactic Chainalysis calls “blockchain dead drops,” according to a report the analytics firm published on September 17.

The practice has surged 420% over the past year and 440% since open-source Chinese AI models began generating malicious code, with North Korean and Iranian state-linked groups now responsible for roughly two-thirds of new activity.

How Blockchain Dead Drops Work Blockchain dead drops, or BDDs, store malware payloads and command-and-control configuration data in on-chain transactions and smart contracts, where infected machines can retrieve them on demand.

Because public blockchains cannot be taken offline, the technique gives campaigns a durability that survives domain seizures, hosting takedowns and repository removals. The danger is not greater destructive power, Chainalysis notes, but greater campaign longevity.