Malware's new hiding place is the blockchain itself

Stop looking for the command-and-control server. According to Chainalysis, a growing number of threat actors are not using one. Instead they are writing their malware's instructions onto public blockchains, records that cannot be seized, taken down or quietly edited, and letting infected machines read them back on demand.

What a blockchain dead drop is

Chainalysis calls the technique a blockchain dead drop. Payloads are stored in on-chain transactions and smart contracts, where an infected device can retrieve them whenever it checks in. The permanence that makes a ledger trustworthy is exactly what makes it useful to an attacker: domain seizures, hosting takedowns and repository removals do not touch it. Chainalysis is explicit that the danger is not extra destructive power but campaign durability, because a blockchain gives threat actors a coordination layer that survives the disruption their ordinary web infrastructure would not.

The number that matters

Chainalysis's research puts malicious writes to blockchains at 2.06 per day before the arrival of high-capacity open-weight Chinese models, and 11.1 per day afterwards, a 440% increase in less than a year. Measured across the previous twelve months, the activity is up 420%. The company's explanation is blunt: building an effective dead drop used to require real expertise in both cybersecurity and crypto. The mid-2025 wave of sufficiently capable open-weight models, released without restrictions on generating malicious code, removed that barrier, and far less experienced actors could suddenly do it.

Who is doing it, and where it started

Chainalysis says nation-state operators now account for the majority of blockchain dead-drop activity, led by North Korea and Iran. It traces the technique back more than a decade: a Necurs botnet variant storing command-and-control domains on Namecoin in 2013, command-and-control IP addresses encoded into Bitcoin transaction amounts in 2019, and the Glupteba botnet writing into Bitcoin's OP_RETURN field the same year. EtherHiding brought the approach to Ethereum-compatible blockchains in mid-2023, after Cloudflare took down the servers the ClearFake operators were using to deliver their malware and they moved the code into smart contracts on Binance Smart Chain instead. Iranian operators tied to the regime's Ministry of Intelligence embedded command-and-control data in Bitcoin transactions in late 2024, and North Korean agents folded EtherHiding into their fake job-interview lures in early 2025.

Chainalysis says it is now tracking the activity across five major blockchains and more than a dozen named malware strains.

Why defenders should care

Most threat-intelligence platforms do not watch public ledgers, which leaves a visibility gap that happens to sit in the attacker's favour. The awkward part for defenders is not that a blockchain dead drop is clever. It is that the standard playbook of blocking, seizing and reporting stops working. Blocking a domain is pointless when the domain is a ledger entry, and you cannot serve a takedown notice on a smart contract.

Our opinion

There is a tidy irony in the crypto world's oldest boast, immutability, being repurposed as malware infrastructure, and Chainalysis obviously has a commercial interest in being the company that can see it. So treat 440% with the scepticism any vendor statistic deserves: it comes from one firm's own telemetry, and writes per day counts transactions, not victims, infections or successful intrusions. What it does not deserve is doubt about the direction of travel. Knocking the skill barrier off a durable, seizure-proof command channel is a genuine change in what a campaign costs to run, and nothing in the open-weight model ecosystem is going to put that barrier back. The real question is no longer whether attackers will use public ledgers. It is whether anyone defending a network can afford not to read them.