Malicious Code Commands Stored on Blockchain Rise 420% in a Year

Malicious code operators have stored command-and-control (C2) information and next-stage payload locations on public blockchains, increasing by 420% in the past year. The blockchain itself was not hacked; instead, its immutable on-chain data layer is being abused as part of malicious communication infrastructure. Chainalysis named this method 'Blockchain Dead Drops (BDD)' on February 17. Attackers record server addresses and settings for infected devices to read via transaction data or smart contracts, while actual data theft and remote control occur off-chain. Chainalysis stated that activity of recording malicious commands on blockchains rose 420% over the past 12 months. Following the emergence of Chinese high-performance open-source AI models, daily average on-chain malicious records jumped from 2.06 to 11.1 per day—a 440% increase.

These two figures are based on different timeframes. The core of BDD is not executing malware directly on the blockchain but recording next-stage payload locations or C2 server addresses on-chain for infected devices to retrieve. A common sub-technique is 'EtherHiding.' Google Threat Intelligence Group confirmed this method in the 2023 ClearFake campaign, and North Korean-linked UNC5342 has used it since February 2025 to target cryptocurrency developers. UNC5342 provided information for JADESNOW downloaders on BNB Smart Chain and Ethereum smart contracts, leading to execution of INVISIBLEFERRET malware that targeted browser passwords, session cookies, credit card details, and crypto wallet data from MetaMask and Phantom.

Blockchain Dead Drops differ from traditional centralized C2 servers. Even if domains or servers are blocked, attackers can record new addresses on-chain, allowing already infected devices to update their communication targets. This structure focuses more on campaign persistence than destructive impact. Centralized servers can be disconnected via domain seizures or hosting blocks, but data remaining on the blockchain is harder to delete. However, this does not mean the blockchain itself was compromised—blockchains were used as a storage and retrieval layer for C2 settings and payload locations, not as an initial infection vector. Initial infections occurred through fake job offers, malicious files, or tampered developer repositories.

General wallet users are not automatically infected just because malicious data is recorded on the blockchain. Google also identified cases where attackers used RPC nodes and API providers rather than direct blockchain communication. In a case analyzed by Canada's Cyber Security Centre, malicious JavaScript read transaction information on Tron and Aptos before downloading payloads from BNB Smart Chain. This means RPC/API providers could serve as control points to monitor and block abnormal calls without restricting normal wallet or DApp usage, requiring targeted responses at the address, contract, and call pattern level.