Question 1

What is a blockchain dead drop?

Accepted Answer

It is a technique, named by Chainalysis, in which attackers store malware payloads or command-and-control pointers inside on-chain transactions and smart contracts, so infected devices can retrieve them and the setup survives domain seizures and server takedowns.

Question 2

Which blockchains did the North Korean and Iranian hackers use?

Accepted Answer

According to Chainalysis, the North Korea-linked group UNC5342 used Tron, Aptos, and BNB Smart Chain, routing devices first through Tron and falling back to Aptos, while suspected Iran-linked actors embedded C2 routing data in Bitcoin transactions, including payments to a Bitcoin address historically tied to Satoshi Nakamoto.

Question 3

Why did on-chain malware activity spike over the past year?

Accepted Answer

Chainalysis recorded a 440% rise in malicious writes since July 2025, when high-capacity open-source Chinese AI models became capable of generating malicious code with limited safeguards, though the firm said it could not prove the attackers used those models to increase their output.

PKW

North Korea and Iran drive 5.2x jump in malware hidden on public blockchains

One sharp brief.
Every day.

PKW

North Korea and Iran drive 5.2x jump in malware hidden on public blockchains

One sharp brief.Every day.

One sharp brief.
Every day.