The digital landscape is witnessing a fundamental shift in how threat actors maintain control over their malicious operations, moving away from vulnerable centralized servers toward the immutable infrastructure of public blockchains. A new investigative report highlights a surging trend known as "blockchain dead drops" (BDDs), a technique where cybercriminals and nation-state agents store malicious code and command-and-control (C2) instructions within the blocks of public ledgers. Unlike traditional web domains or hosting services, these decentralized databases are censorship-resistant and cannot be taken offline by law enforcement or internet service providers. This permanence provides threat actors with a coordination layer that survives domain seizures, hosting takedowns, and repository removals, creating a persistent visibility gap for traditional cybersecurity platforms.
Research indicates that BDD attacks have escalated dramatically, rising by 420% over the past 12 months. This surge is closely linked to the proliferation of open-source artificial intelligence coding tools, which have lowered the technical barrier to entry for deploying complex on-chain infrastructure. Data shows that since the rise of high-capacity AI coding models, malicious writes to blockchains have increased from an average of 2.06 per day to 11.1 per day—a staggering 440% increase. While the technique was pioneered by financially motivated cybercriminals, it has been rapidly adopted by sophisticated nation-state actors from North Korea, Iran, and Russia, who now account for approximately two-thirds of new BDD activity.
The Mechanics of Blockchain Dead Drops
The term "blockchain dead drop" is a digital evolution of traditional espionage tradecraft, where operatives leave physical materials at a pre-arranged, inconspicuous location for later retrieval. In the cyber realm, a BDD serves as a takedown-resistant repository for malware payloads or dynamic C2 configuration pointers. Once a device is infected with initial malware, it is programmed to query a specific blockchain address or smart contract to retrieve the current address of the attacker’s off-chain infrastructure.
Security analysts have identified several primary methods used to facilitate these drops. The first is transaction-based storage, where attackers embed encoded data directly into transaction fields, such as Bitcoin’s OP_RETURN or the input data fields on the Binance Smart Chain (BSC). The second is contract-based storage, often referred to as "EtherHiding." In this model, malicious instructions are stored within the state of a smart contract. Compromised machines interact with these contracts through standard Remote Procedure Call (RPC) nodes, allowing them to receive updates automatically whenever the attacker broadcasts a new transaction to the contract.
A more recent and stealthy variation involves the use of "phantom wallets." These are blockchain addresses that do not have a corresponding private key-pair. Attackers hide their C2 server’s IP address within the bytes of the phantom address itself. By sending zero-value transactions to these addresses, they create a permanent, searchable record. The malware is designed to monitor these transactions, decode the IP address from the destination wallet, and establish a connection to the attacker’s server. This method is particularly difficult to detect because it does not rely on traditional data fields that security scanners typically monitor.
A Chronological Evolution: From Necurs to EtherHiding
The use of blockchains as a coordination layer is not entirely new, but its complexity and scale have evolved significantly over the last decade. The earliest recorded instance dates back to 2013, when the Necurs botnet began using Namecoin—a fork of Bitcoin—to store C2 domains that were immune to traditional DNS takedowns. For several years, the technique remained a niche strategy used by a handful of advanced groups.
In 2019, the landscape began to shift as operators of the Glupteba crypto-mining botnet utilized Bitcoin’s OP_RETURN field to update their server addresses. Simultaneously, the Pony banking malware began encoding C2 IP addresses into the specific amounts of Satoshis (the smallest unit of Bitcoin) being transferred in transactions. These early efforts proved that blockchains could serve as a reliable "fallback" mechanism when traditional domains were seized.
The modern era of BDDs began in mid-2023 with the emergence of EtherHiding. This technique gained prominence when the operators of ClearFake, a widespread malware-delivery campaign, faced a crackdown from Cloudflare. To maintain their campaign, they migrated their malicious code to smart contracts on the Binance Smart Chain. By late 2023, the Smargaft DDoS botnet followed suit, utilizing BSC for its C2 infrastructure. The success of these criminal enterprises caught the attention of nation-state intelligence agencies, leading to the sophisticated, multi-chain strategies observed in 2024 and 2025.
Case Study: North Korean Redundancy and Cross-Chain Relays
North Korean threat actors, particularly the group tracked as UNC5342, have demonstrated the most sophisticated use of BDDs to date. In early 2025, these actors targeted cryptocurrency developers with a "fake job interview" ruse. Victims were duped into downloading what they believed were coding tests, which were actually malicious payloads.
To ensure the longevity of this campaign, UNC5342 implemented a redundant cross-chain relay system. The malware was programmed to query the TRON and Aptos blockchains for encoded pointers. These pointers directed the infected device to a specific transaction on the Binance Smart Chain, which contained the encrypted malware instructions. If the TRON query failed due to network issues or node rate-limiting, the malware would automatically fall back to the Aptos route.
This three-chain architecture makes the operation nearly impossible to disrupt. For a defender to stop the malware from receiving updates, they would need to coordinate a simultaneous intervention across TRON, Aptos, and BSC—an impossible task given the decentralized nature of these networks. This activity aligns with North Korea’s broader strategic goal of stealing digital assets to fund the regime’s weapons programs.
Case Study: Iranian Ministry of Intelligence and Bitcoin OP_RETURN
Iranian threat actors linked to the nation’s Ministry of Intelligence have adopted a different but equally effective strategy. These operators use the Bitcoin blockchain to write C2 infrastructure data into transactions involving well-known "Satoshi-era" addresses—wallets that have existed since the earliest days of Bitcoin.
By sending small, economically meaningless payments to these historic addresses, the attackers create a permanent lookup point for their malware. The malware does not interact with the attacker’s wallet; instead, it monitors the public transactions associated with the historic address. When the attacker needs to rotate their server infrastructure, they simply broadcast a new transaction with updated encoded data. This reduces the attacker’s on-chain footprint and leverages the public nature of the blockchain to ensure every infected device picks up the change automatically.
Case Study: Russian-Language Malware-as-a-Service
The commercialization of BDD techniques is most evident in Russian-language criminal forums. Security firms have documented the "ErrTraffic" toolkit, a Malware-as-a-Service (MaaS) framework that utilizes EtherHiding on the Polygon blockchain. In this model, a central operator maintains a fleet of smart contracts that act as C2 resolvers. These contracts are then rented out to downstream affiliates who run their own independent malware campaigns, such as credential theft or clipboard hijacking.
On-chain analysis of these operator wallets has revealed a massive footprint, connecting single deployers to fraudulent tokens impersonating stablecoins and hundreds of near-identical resolver contracts across multiple chains. This "industrial-scale" approach shows how BDDs have moved from a bespoke hacking technique to a standardized component of the modern cybercrime economy.
The AI Catalyst and the Visibility Gap
The recent 440% explosion in BDD activity is directly attributed to the release of powerful, open-weight AI models, particularly those originating from China in mid-2025. These models, which often lacked the stringent safety filters found in Western AI counterparts, allowed less experienced cybercriminals to generate the complex smart contract code and decoding logic required for BDDs.
This democratization of the technique has created a significant visibility gap. Traditional threat intelligence platforms are designed to monitor web traffic, domain registrations, and server IPs. They are not equipped to parse the millions of daily transactions on a blockchain for hidden hexadecimal strings or malicious smart contract calls. Consequently, a campaign can remain active and undetected for months, even after its primary web-based components have been identified and "neutralized."
Defensive Realities and the Role of Blockchain Intelligence
Addressing the threat of blockchain dead drops presents a unique challenge for digital defenders. It is not feasible to block blockchain traffic at the network level. Most modern enterprises and financial institutions rely on legitimate blockchain applications, decentralized finance (DeFi) services, and public RPC endpoints operated by companies like Cloudflare, Infura, and Alchemy. Blocking "Ethereum traffic" would break these essential services while doing little to stop an attacker, who could simply host their own node or use a different RPC provider.
The solution lies in the same immutability that makes blockchains attractive to attackers. Because every transaction is permanent and timestamped, the blockchain provides a "perfect record" of the attacker’s infrastructure history. Blockchain intelligence tools can map the funding chains of operator wallets, identify the deployment of resolver contracts, and track the rotation of C2 servers in real-time.
By monitoring outbound JSON-RPC calls to public blockchain endpoints, organizations can gain an early-warning signal that a device on their network is attempting to "call home" via a dead drop. This metadata, when combined with traditional endpoint visibility, allows defenders to profile the adversary and tailor their response.
Implications for the Future of Cybersecurity
The rise of blockchain dead drops signals a new era of "durable" cyber warfare. As long as public blockchains remain decentralized and accessible, they will continue to serve as a refuge for malicious code. The shift from state-sponsored actors adopting criminal techniques—and then refining them for national intelligence goals—suggests that BDDs will become a permanent fixture in the arsenal of groups like North Korea’s Lazarus or Iranian state-linked units.
For the cybersecurity industry, the emergence of BDDs necessitates a convergence of traditional network security and blockchain analytics. The "cat-and-mouse" game has moved to a platform where the "cat" (the defender) cannot simply remove the "mouse’s" (the attacker’s) hiding spot. Instead, the focus must shift toward attribution, downstream disruption, and the use of automated threat monitoring to close the visibility gap. As AI continues to lower the barriers to entry, the volume and complexity of these on-chain threats will likely only increase, making blockchain literacy an essential requirement for the modern digital defender.
