North Korea and Iran drive 5.2x jump in malware hidden on public blockchains

The Thursday report published by the Blockchain analytics firm set off alarms at exchanges, wallet providers, and security teams, as these kinds of malicious codes exploit blockchain’s nature to persist longer than those parked on traditional servers or domains that can be taken down by seizing the site.

What is a blockchain dead drop? 

According to Chainalysis, the “blockchain dead drop” or BDD technique is a process where attackers park payloads and command-and-control pointers inside on-chain transactions and smart contracts. That way, infected machines can fetch them when it’s time to act. 

The method became popular among hackers because of how blockchain technology, by its nature, exponentially increases the viability of stored data. Campaigns die a natural death when the domain gets seized, hosting is cut off, or the code repository is removed. However, instructions stored on a public ledger persists and remains accessible through all these conditions.

Per Chainalysis, the first instance of this tactic on record goes as far back as 2013, when a Necurs botnet variant parked its C2 domains on Namecoin. In a separate 2019 case, operators of the Glupteba mining botnet used Bitcoin’s OP_RETURN field to hide data. 

The trend spread under the EtherHiding label to Ethereum-style chains in mid-2023. The first of its kind happened when ClearFake operators migrated their infostealer code to BNB Smart Chain after Cloudflare took down their servers. 

As of early 2024, ordinary cybercriminals were responsible for most of the activity. However, fast forward to the second quarter of 2026, Chainalysis is now reporting that nation-state operators are now writing roughly two of every three dead-drop on public blockchains. 

North Korean and Iranian operators are active 

Chainalysis completed the loop on an investigation by connecting a set of previously unattributed transactions across three networks to a North Korea-tied group on Google Threat Intelligence’s radar, UNC5342. 

That campaign, which routed infected devices through Tron, Aptos as a backup, and ending at the same BNB Smart Chain transaction, mirrored another instance from 2025 when North Korean hackers planted crypto-stealing code inside Ethereum-style smart contracts (EtherHiding).

Chainalysis also found links to Iran’s Ministry of Intelligence while investigating an operation that encoded C2 routing data directly on the Bitcoin blockchain. 

The Iranian method carried the unusual signature of sending tiny payments from attacker wallets to a Bitcoin address rumored to have ties to Satoshi Nakamoto. 

Open-weight AI models have aided the operations

The 440% rise in malicious dead drops since July 2025 has coincided with the most advanced open-source Chinese AI models unlocking the capacity to write A-level code. In raw terms, writes went up from about 2.06 to 11.1 a day.

Eric Jardine, Chainalysis’s cybercrimes research lead, said the firm could not confirm the actors publishing the malicious transactions had actually used the models to boost their output.

The report lands on top of a long run of North Korean crypto activity. CertiK estimated in May that DPRK-linked actors have stolen about $6.75 billion since 2016 across 263 incidents, leaning on social engineering rather than pure software exploits.

Separate research presented at Black Hat this year put the reach wider still, with one investigator finding North Korean operators had infiltrated 1,640 companies across 57 countries. U.S. intelligence has said funds taken by these operations help pay for the regime’s nuclear and missile programs, a charge Pyongyang has denied.