Chainalysis reports blockchain dead drops, or malicious on-chain command-and-control payloads, surged 440% since mid-2025 after unrestricted Chinese open-source AI models, with daily malicious writes rising from 2.06 to 11.1 and state-linked actors producing roughly two-thirds of new activity by Q2 2026. North Korea’s UNC5342, suspected Iranian operators and Russian-language groups now use TRON, Aptos, BNB Smart Chain, Bitcoin and Polygon to host resilient C2 infrastructure, and supply-chain attacks like ChainDrop impacted over 440 npm packages in August 2026, highlighting escalating crypto security risks for wallets, DeFi, DEX/CEX tooling and investigators.
See what traders are focused on
Malware commands hidden on blockchains rose 440% after Chinese AI open-source models launched.
State-linked hackers now account for two-thirds of new blockchain dead drop activity.
North Korea, suspected Iranian, and Russian-language groups each run distinct on-chain command systems.
Attackers are posting malware instructions to blockchains 440% more often since unrestricted Chinese open-source AI models arrived, Chainalysis reported. Daily malicious on-chain writes climbed from 2.06 to 11.1 in under a year.
Chainalysis calls the technique blockchain dead drops (BDDs). State-linked operators from North Korea and Iran now generate most of the activity, the firm found.
Censorship Resistance Turns Into a Hacking Asset
In its latest report, Chainalysis noted that hackers stored malicious code on centralized servers that could get seized, blocked, or pulled offline. However, now attackers store them on public blockchains.
“We call this technique ‘blockchain dead drops’ (BDD). BDDs store payloads in on-chain transactions and smart contracts where infected devices can retrieve them on demand. The permanence of blockchains gives threat actors’ cyber campaigns longevity; they can communicate with compromised machines without fear of losing their command-and-control (C2) relayer,” the report read.
“We call this technique ‘blockchain dead drops’ (BDD). BDDs store payloads in on-chain transactions and smart contracts where infected devices can retrieve them on demand. The permanence of blockchains gives threat actors’ cyber campaigns longevity; they can communicate with compromised machines without fear of losing their command-and-control (C2) relayer,” the report read.
The firm stresses that the danger lies in durability , not firepower. Campaigns survive domain seizures, hosting takedowns, and repository removals. The technique dates to 2013, when a Necurs botnet variant stored domains on a Bitcoin (BTC) fork called Namecoin.
It reached Ethereum Virtual Machine (EVM) chains in 2023 as EtherHiding. Google later caught North Korea’s UNC5342 using it in fake job interviews.
Chainalysis pins the recent explosion to mid-2025. That is when powerful open-weight Chinese models launched with no guardrails against writing malicious code. That erased the skill barrier that once kept dead drops rare, the firm said.
The spread now reaches well beyond crypto. Netskope researchers say the ChainDrop supply chain attack hit more than 440 npm packages in August 2026.
Pyongyang, Tehran, and Russian Forums Write Their Own Playbooks
Cybercriminals accounted for nearly all dead drop activity through early 2024. By Q2 2026, state-linked groups produced roughly two-thirds of new activity each quarter and half the total.
North Korea’s UNC5342 now runs a three-chain relay . Pointers on TRON (TRX) and Aptos (APT) steer infected devices to encrypted devices on BNB Smart Chain.
“The attacker rotates infrastructure by publishing new transactions, and every previously infected device picks up the change automatically. Disrupting the operation would require action across all three chains simultaneously,” the team noted.
“The attacker rotates infrastructure by publishing new transactions, and every previously infected device picks up the change automatically. Disrupting the operation would require action across all three chains simultaneously,” the team noted.
Suspected Iranian intelligence operators send tiny Bitcoin payments to a well-known address linked to Satoshi Nakamoto . Chainalysis said the malware searches for data inside each transaction, then decodes it to retrieve the current attacker infrastructure.
Russian-language criminals, meanwhile, sell the capability as a service. One operator wallet on Polygon (POL) controls a fleet of resolver contracts, each apparently serving a different paying customer.
Defenders cannot simply block blockchain traffic without breaking every legitimate wallet and app, the report noted. The same permanence that shelters attackers, however, leaves every update on a public ledger.
Whether investigators can turn that trail into arrests faster than AI tools mint new operators is the open question.
See what traders are focused on
Meme Coin Launchpads Captured 82% of Arc's First Day Trading Volume
Tokenized Stocks Draw $247.8 Million Into DeFi: What Are They Actually Used For?
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
