Chainalysis says malware operators are storing instructions on blockchains as on-chain malicious writes jump 440%

Blockchain analytics firm Chainalysis said in a new report that cyber attackers are increasingly storing malware instructions on public blockchains, a technique it described as "dead drops" on-chain. The company said the attackers are not compromising blockchain protocols themselves. Instead, they are using the public and persistent data layer of blockchains as infrastructure. According to the report, malicious on-chain write activity tied to this technique has surged by about 440% since mid-2025. Chainalysis also linked different forms of the activity to actors associated with North Korea and Iran, as well as Russian-speaking cybercrime groups motivated by financial gain. The firm said the trend should change how defenders look at blockchain activity. For wallet providers and security teams, monitoring can no longer focus only on stolen funds or suspicious transfers. Public blockchain data may also be used to host operational instructions for malware.