Blockchain Dead Drop Attacks Surge 420% Amid State-Sponsored Cyber Activity

Blockchain dead drop attacks, which utilize public blockchain networks to conceal malware instructions, have surged by 420% over the past year, according to a report by Chainalysis. This increase is largely attributed to state-linked groups, which accounted for approximately two-thirds of new activity in the second quarter of 2026.

The report highlights a significant rise in malicious blockchain writes, escalating from an average of 2.06 per day prior to the introduction of advanced Chinese AI models in mid-2025 to 11.1 per day, marking a 440% increase in less than a year. The technique, referred to as blockchain dead drop (BDD), involves attackers embedding malware payloads or pointers within transaction data or smart contracts, allowing infected devices to connect to the attackers' offchain systems for credential theft or data exfiltration.

Chainalysis detailed a campaign linked to North Korea, where operators encoded pointers on the Tron and Aptos blockchains that directed infected devices to a transaction on the BNB Smart Chain. This method allows attackers to rotate their offchain servers while maintaining access to their malware. Additionally, Google Threat Intelligence Group reported similar tactics employed by a North Korean group targeting cryptocurrency developers through fake job interviews.

The report also noted that while state-sponsored groups have become increasingly active in this domain, cybercriminals were responsible for nearly all blockchain dead-drop activity until early 2024. By mid-2026, state-linked groups represented half of all tracked activity, indicating a shift in the landscape of blockchain-related cyber threats.

© 2026 KLEA News. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.

Source: KLEA News