Surge in Blockchain Dead Drops Driven by AI Models

• •Blockchain dead drops have surged 440% since mid-2025 due to AI advancements.
• •State-linked actors from North Korea and Iran dominate this new attack vector.
• •Traditional cybersecurity measures are struggling to detect on-chain malicious activities.

Cyber threat actors have significantly increased the use of blockchain dead drops (BDDs) to hide malware instructions, with a 440% surge in activity since mid-2025, attributed to unrestricted Chinese open-source AI models. This technique allows attackers, particularly state-linked groups from North Korea and Iran, to store malicious payloads on public blockchains, making them difficult to disrupt. The average daily malicious on-chain writes rose from 2.06 to 11.1, with state actors now accounting for two-thirds of this activity. The BDD method enhances campaign durability by allowing communication with compromised devices without fear of takedowns. Notable incidents include the Glupteba campaign, which has evolved to exploit vulnerabilities in network routers and utilize Bitcoin transactions for command and control. The rise in BDDs poses a growing challenge for cybersecurity, as traditional threat intelligence platforms struggle to detect on-chain activities. Overall, the combination of AI advancements and blockchain technology has created a new landscape for cyber threats.