Chainalysis Tracks a 440% Jump in Malware Hidden on Public Blockchains

Attackers are increasingly storing malware instructions on public blockchains, where a hosting company can’t pull them down and a domain seizure can’t touch them. Chainalysis calls the technique “blockchain dead drops,” and in new research it says malicious writes to blockchains rose from 2.06 a day to 11.1 a day, a 440% increase in under a year.

The jump followed the mid-2025 release of powerful open-weight Chinese models that had no restrictions on generating malicious code, according to Chainalysis. Building a dead drop used to take real expertise in both malware and crypto. Those models lowered the bar for less experienced attackers. Chainalysis now tracks the activity across five major blockchains and more than a dozen named malware strains.

“The danger of blockchain dead drops is not greater destructive power. The danger is greater campaign durability,” the firm wrote. Infected machines read a transaction or smart contract to find the attacker’s current server, and the attacker rotates infrastructure by posting a new transaction.

State groups now lead

Through early 2024, nearly all of this activity came from cybercriminals. State-linked groups showed up in mid-2024, and by the second quarter of 2026 they were responsible for roughly two-thirds of new dead-drop activity each quarter and half of the total.

Chainalysis described three cases:

• North Korea: UNC5342, the group Google Threat Intelligence tracks for fake job interviews targeting crypto developers, uses transactions on TRON and Aptos that both point to encrypted instructions on BNB Smart Chain. If one route fails, the malware tries the other. Disrupting it would take action on all three chains at once, TechRadar noted.
• Iran: Operators Chainalysis suspects are tied to Iran’s Ministry of Intelligence send small payments to a well-known Bitcoin address historically linked to Satoshi Nakamoto, embedding encoded server details in the transaction data.
• Russian-language criminals: A malware-as-a-service kit sold on criminal forums uses Polygon smart contracts, with one operator wallet controlling a fleet of storage contracts for different customers.

An old trick, scaled up

The idea isn’t new. A Necurs botnet variant stored command domains on Namecoin in 2013, and the “EtherHiding” approach of storing malicious code in smart contracts appeared on BNB Smart Chain in 2023 after Cloudflare cracked down on the ClearFake operators’ servers.

The upside for defenders is that blockchains are public. Every write is visible, so the same permanence that protects attackers also leaves a record. Chainalysis argues that traditional threat-intelligence platforms can miss on-chain activity and that adding blockchain monitoring closes that gap, letting security teams flag the contracts and addresses that malware polls.