{"id":229568,"date":"2026-09-19T15:15:00","date_gmt":"2026-09-19T15:15:00","guid":{"rendered":"https:\/\/mycryptomania.com\/?p=229568"},"modified":"2026-09-19T15:15:00","modified_gmt":"2026-09-19T15:15:00","slug":"chainalysis-warns-malware-operators-are-turning-blockchains-into-dead-drops","status":"publish","type":"post","link":"https:\/\/mycryptomania.com\/?p=229568","title":{"rendered":"Chainalysis Warns Malware Operators Are Turning Blockchains Into Dead Drops"},"content":{"rendered":"

TL;DR<\/strong><\/p>\n

Chainalysis says cyber attackers are increasingly storing malware instructions on public blockchains.
\nIt calls the technique \u201cBlockchain Dead Drops.\u201d
\nThe blockchain itself is not compromised; attackers are using its public, persistent data layer.<\/p>\n

Cybercriminals have found a new use for public blockchains, and it has nothing to do with moving money.<\/p>\n

Chainalysis says a growing number of threat actors are storing command-and-control information for malware directly on-chain<\/a>, creating what the analytics firm calls Blockchain Dead Drops<\/strong>, or BDDs.<\/p>\n

The idea is clever in an unpleasant sort of way.<\/p>\n

Traditional malware often relies on a server or domain to tell infected machines what to do next. Security teams can block the domain, seize the server or disrupt the infrastructure.<\/p>\n

A public blockchain is considerably harder to take offline.<\/p>\n

Attackers can place configuration data, addresses or pointers inside transactions or smart contract<\/a> state and then instruct malware to read that information directly from the chain.<\/p>\n

The Blockchain Becomes The Noticeboard<\/h2>\n

Chainalysis describes the wider technique as EtherHiding.<\/p>\n

Instead of compromising a blockchain protocol, attackers are effectively using the network as a highly resilient public bulletin board.<\/p>\n

Once information is written on-chain, defenders cannot simply delete it.<\/p>\n

That makes BDDs attractive for command-and-control infrastructure because attackers can change the data their malware reads without relying on a conventional web server that could be seized.<\/p>\n

Chainalysis says activity involving these techniques has climbed sharply, with malicious on-chain writes rising about 440% since mid-2025. The research links different forms of the technique to actors associated with North Korea and Iran, as well as financially motivated Russian-language cybercrime groups.<\/p>\n

Those attribution claims come from Chainalysis\u2019 own research and should be read that way.<\/p>\n

This Is Not A Blockchain Exploit<\/h2>\n

That distinction is important.<\/p>\n

Nothing about this technique suggests that Bitcoin<\/a>, Ethereum<\/a>, BNB Chain, Tron or other networks have had their underlying cryptography broken.<\/p>\n

The attacker is using a feature that blockchains are deliberately designed to provide: public, persistent data.<\/p>\n

It is the same property that allows anyone to verify transactions years later.<\/p>\n

The security problem appears when malware treats that permanent data layer as infrastructure.<\/p>\n

That creates a frustrating problem for defenders. The malicious software can still be detected and removed from infected devices, but the data it relies on may remain publicly accessible indefinitely.<\/p>\n

For crypto infrastructure operators, wallet<\/a> providers and security teams, that means monitoring blockchain activity increasingly has to account for more than stolen funds and suspicious transfers.<\/p>\n

Sometimes the payload is information itself.<\/p>\n

Source: Chainalysis research \u2014 https:\/\/www.chainalysis.com\/blog\/etherhiding-blockchain-dead-drops\/<\/a><\/p>\n

This article was written by the News Desk and edited by Samuel Rae.<\/p>\n

This report is based on information released by Chainalysis. at Chainalysis<\/a><\/p>","protected":false},"excerpt":{"rendered":"

TL;DR Chainalysis says cyber attackers are increasingly storing malware instructions on public blockchains. It calls the technique \u201cBlockchain Dead Drops.\u201d The blockchain itself is not compromised; attackers are using its public, persistent data layer. Cybercriminals have found a new use for public blockchains, and it has nothing to do with moving money. Chainalysis says a […]<\/p>\n","protected":false},"author":0,"featured_media":229569,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-229568","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-discovery"],"_links":{"self":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts\/229568"}],"collection":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=229568"}],"version-history":[{"count":0,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts\/229568\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/media\/229569"}],"wp:attachment":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=229568"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=229568"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=229568"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}