Malware that phones home via a blockchain instead of a server is no longer a novelty. It is now a nation-state habit.
Blockchain-assisted attacks, where hackers hide command-and-control instructions or malicious code inside public blockchain transactions and smart contracts, have risen more than fivefold over the past year, according to a report from blockchain analytics firm Chainalysis. The technique, dubbed Blockchain Dead Drops, lets infected machines pull instructions from the blockchain rather than a server that police or hosting providers could simply shut down. Daily malicious blockchain writes climbed from 2.06 to 11.1, a 440% jump that Chainalysis pins partly on freely available Chinese open-weight AI models, which it says have made building these attacks accessible to far less skilled operators. By the second quarter of 2026, state-linked groups from Iran, North Korea, and Russia accounted for roughly two-thirds of new dead-drop activity, despite only entering the field in mid-2024.
The appeal is durability, not stealth. A malicious website can be taken down in hours. A smart contract on a public blockchain effectively cannot be, short of blocking access to the entire network, which would also break every legitimate wallet and DeFi app relying on it. That tradeoff is why defenders cannot respond by filtering blockchain traffic wholesale, and why the fight has shifted to spotting the off-chain infrastructure and unusual outbound traffic to blockchain endpoints instead.
There is a catch for the attackers, though. Blockchains do not forget. Every time an operator rotates a C2 pointer, that update is permanently timestamped and public, exactly the kind of trail investigators use to tie separate campaigns back to the same group. The infrastructure built to be unkillable is also quietly handing investigators a permanent case file.