Blockchain-assisted cyberattacks surge fivefold, driven by Iranian and North Korean state actors, Russia-linked groups

Blockchain-assisted cyberattacks have surged fivefold since the previous year, according to a Chainalysis report. These attacks are increasingly being carried out by Iranian and North Korean state actors, along with Russian-speaking criminal groups. Instead of storing malicious payloads on vulnerable servers, attackers now utilize public, censorship-resistant blockchains to store these payloads.

This technique, known as Blockchain Dead Drops (BDD), allows attackers to maintain a resilient infrastructure for command-and-control, making takedowns extremely difficult. The widespread availability of Chinese AI tools has lowered the technical barriers for cybercrime, leading to a reported 440% rise in BDD attacks. BDD involves storing either malware payloads or dynamic command-and-control configurations on blockchain.

In C2 setups, the on-chain data contains config information directing infected devices to the attacker's current infrastructure. Malware retrieves and decodes this data off-chain to connect to the real C2 server. Payload delivery setups store malicious code or encrypted components on-chain for victims to retrieve and execute. Chainalysis identified transaction-based and contract-based storage techniques used by threat actors to hide malware on-chain.

Nation-state actors, particularly Iranian and North Korean groups, are driving the surge in attacks. By Q2 2026, state-actor-linked groups were responsible for around two-thirds of new BDD activity, with half of the total BDD activity, despite only entering the scene in mid-2024.