Chainalysis: Blockchain 'Dead Drop' attacks surge 420% in 12 months

According to a Chainalysis report, the use of 'blockchain dead drops'—a technique involving the storage of malicious payloads or C2 configurations within on-chain transactions and smart contracts—has increased by approximately 420% over the past 12 months. Daily malicious writes rose from 2.06 to 11.1, with over 15 active campaigns identified across five major public blockchains. As of Q2 2026, state-sponsored actors account for about two-thirds of new activity. North Korea's UNC5342 has been targeting crypto developers via fake job offers since February 2025, utilizing TRON, Aptos, and BSC. Entities linked to the Iranian Ministry of Intelligence have been using Bitcoin (BTC) OP_RETURN to encode data since late 2024, while Russian-speaking criminal groups are operating malware-as-a-service on Polygon.