Chainalysis reports a 440% increase in malware instructions posted to blockchains, with daily malicious writes rising from 2.06 to 11.1 in less than a year. The firm attributes this surge to the mid-2025 release of unrestricted Chinese open-source AI models, which lowered the technical barrier for creating these so-called blockchain dead drops (BDDs).
This technique allows attackers to store malicious payloads within on-chain transactions and smart contracts, ensuring long-term persistence that survives domain seizures or repository removals. While the method dates back to 2013, it gained significant traction with the 2023 emergence of EtherHiding on Ethereum Virtual Machine chains and subsequent use by groups like North Korea's UNC5342.
By the second quarter of 2026, state-linked groups from North Korea and Iran accounted for roughly two-thirds of new activity and half of the total volume. North Korean operators now utilize a multi-chain relay system across TRON, Aptos, and BNB Smart Chain, while suspected Iranian actors embed data within Bitcoin transactions sent to a Satoshi Nakamoto-linked address.
The threat has expanded beyond the crypto ecosystem, with researchers at Netskope identifying a supply chain attack dubbed ChainDrop that impacted over 440 npm packages in August 2026. Russian-speaking cybercriminals have also begun commercializing this capability, offering it as a service through resolver contracts on the Polygon network.
