--- title: "Blockchain dead drops surge 440% as North Korea… | Firevault" url: https://fire-vault.com/news/blockchain-dead-drops-malware-surge-2026 description: "Chainalysis research shows malicious blockchain writes rising from 2.06 to 11.1 a day in under a year, with state-linked groups now behind most new activity.…" lang: en-GB --- News · Threat Analysis · 24 September 2026 # Blockchain dead drops surge 440% as North Korea and Iran hide malware on public ledgers Chainalysis research shows malicious blockchain writes rising from 2.06 to 11.1 a day in under a year, with state-linked groups now behind most new activity. Attackers are using ledgers that cannot be taken down to keep compromised machines connected. Image: Mark Fermor (https://fire-vault.com/assets/mark-fermor-DWFWqeWL.jpg) Mark Fermor CTO, CMO & Founder, Firevault 3 min read Share Share on LinkedIn: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fblockchain-dead-drops-malware-surge-2026 Share on X: https://twitter.com/intent/tweet?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fblockchain-dead-drops-malware-surge-2026&text=Blockchain%20dead%20drops%20surge%20440%25%20as%20North%20Korea%20and%20Iran%20hide%20malware%20on%20public%20ledgers%0A%0AChainalysis%20research%20shows%20malicious%20blockchain%20writes%20rising%20from%202.06%20to%2011.1%20a%20day%20in%20under%20a%20year%2C%20with%20state-linked%20groups%20now%20behind%20most%20new%20activity.%20Attackers%20are%20using%20ledgers%20that%20cannot%20be%20taken%20down%20to%20keep%20compromised%20machines%20connected. Share on Facebook: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Ffire-vault.com%2Fnews%2Fblockchain-dead-drops-malware-surge-2026 Image: Illustration of a blockchain with a cracked block sending hidden malware instructions to infected laptops, in navy, cyan and magenta (https://fire-vault.com/news/blockchain-dead-drops-malware-surge-2026.jpg) Illustration of a blockchain with a cracked block sending hidden malware instructions to infected laptops, in navy, cyan and magenta Why it matters ## What this means for organisations holding critical data ## What the research found Research published by blockchain analytics firm Chainalysis on 17 September 2026 shows a 440% year-on-year rise in what it calls blockchain dead drops (BDD). In these schemes, attackers write malware instructions, command-and-control (C2) addresses or pointers into public blockchain transactions and smart contracts, where infected devices can look them up on demand. The average number of malicious blockchain writes rose from 2.06 a day to 11.1 a day in less than a year. Chainalysis links the acceleration to the release of high-capacity open-weight Chinese AI models that place no restrictions on generating malicious code, although it notes that its measurement shows correlation rather than proof of cause. ## State actors now lead Groups linked to North Korea and Iran accounted for roughly two-thirds of newly observed dead-drop activity each quarter by the second quarter of 2026, according to the report. State-linked operators now represent around half of all activity Chainalysis tracks, up from a negligible share in early 2024. Techniques differ by actor. A North Korean-linked operation associated with UNC5342 uses TRON and Aptos as alternate routes, while other campaigns rely on BNB Chain, Polygon and Bitcoin. Independent on-chain analysis by Bitquery found that one North Korean wallet named by Google in October 2025 has continued posting payloads, 251 in total, with the most recent on 8 September 2026. Bitquery estimates the whole setup cost around $85 in gas fees. ## Why this matters The danger is not greater destructive power. It is durability. Conventional attack infrastructure depends on servers and domains that hosting providers and law enforcement can seize or block. A public ledger cannot be switched off by any central authority, so instructions written to it remain reachable. Attackers can change their C2 servers simply by writing a new record, without reinfecting a single victim. Blocking the traffic is also difficult. Blockchain RPC endpoints serve legitimate cryptocurrency services worldwide, so defenders cannot simply cut them off without collateral disruption. Chainalysis and others suggest that detection will increasingly depend on monitoring wallets, contracts and RPC traffic from corporate networks. ## The Firevault view Blockchain dead drops are a reminder that takedown is not a strategy. If attacker infrastructure can survive every seizure, the only reliable control is to remove the path between the malware and the data it is sent to find. Malware can only retrieve instructions and exfiltrate records from systems it can reach. Data held on Offline Secure Storage (https://fire-vault.com/offline-secure-storage)® is physically disconnected when not in use, so there is no network path for a dead-drop command to exploit, however permanent the ledger that carries it. Organisations should ask a simple question: which of our critical records would still be reachable if an implant on our network received new orders tomorrow? ## Sources - Chainalysis, "DPRK and Iran are Leading a 5.2x Surge YoY in Blockchain-Assisted Cyberattacks", 17 September 2026 - Bitquery, "EtherHiding and Blockchain Malware, Measured On-Chain", 18 September 2026 - Cyber Security Intelligence, "Hackers Fuel Blockchain Dead Drops", 21 September 2026 - TechRadar Pro and Insurance Journal reporting, September 2026 Sources ## Where this reporting comes from 01 **Original report**Primary coverage referenced in this analysis View original article (https://www.cybersecurityintelligence.com/blog/hackers-fuel-blockchain-dead-drops-9752.html) About the author ### Mark Fermor Mark Fermor on LinkedIn (https://www.linkedin.com/in/mfermor) CTO, CMO & Founder Founder of Firevault, focused on offline secure storage and protecting individuals and businesses from fraud, fines, loss and damage. Speaker, owner and advisor. How Firevault would handle this ## Controls an auditor can physically verify Firevault gives you physical separation, named custody and evidenced access, so compliance claims about isolation and control are things you can show, not just assert. Get started: https://fire-vault.com/get-started Talk to the team: https://fire-vault.com/demo **Custody**Named, access-controlled hardware in a Firevault Bunker **Evidence**Access windows and retrieval events are recorded **Separation**Physical isolation that satisfies offline copy requirements **Jurisdiction**Stored where your regulatory position requires Related Reading ## You may also find these useful Threat Analysis ### Fake job interviews infected 30,000 devices, FBI-led advisory says A joint FBI-led advisory says North Korean WaterPlum actors used fake technical interviews and coding tests to infect at least 30,000 devices in more than 100 countries. 25 Sept 2026 5 min https://fire-vault.com/news/waterplum-contagious-interview-30000-devices-2026 Threat Analysis ### Scattered Spider Guilty Pleas: What the TfL Hack Confirms About Offline Recovery Two Scattered Spider members have admitted the £39m TfL hack. Mark Fermor on identity blast radius and why offline recovery is the deciding layer. 22 Jun 2026 4 min https://fire-vault.com/news/scattered-spider-tfl-guilty-plea-offline-recovery Threat Analysis ### UK critical infrastructure hit by 200 cyber incidents in a year, NCSC warns NCSC chief Richard Horne says the UK faced more than 200 nationally significant cyber incidents against critical infrastructure in a year, with about three-quarters tied to state actors. 20 Jun 2026 5 min https://fire-vault.com/news/ncsc-uk-critical-infrastructure-incidents-double Threat Analysis ### 24 billion credentials exposed in record infostealer leak Cybernews researchers found an 8.3 TB Elasticsearch cluster holding 24 billion records, including plaintext passwords and login URLs harvested from infostealer logs. 19 Jun 2026 4 min https://fire-vault.com/news/24-billion-credentials-infostealer-leak Threat Analysis ### FortiBleed: 74,000 Fortinet firewalls leak plaintext credentials Researchers say a Russian-speaking crew cracked nearly half the internet's Fortinet firewalls, exposing plaintext logins for Oracle, Chevron, Lenovo, FedEx, a NATO defence contractor and Fortinet itself. 18 Jun 2026 4 min https://fire-vault.com/news/fortibleed-74000-fortinet-firewalls-credentials-exposed Breach Analysis ### ASOS data breach: stolen customer profiles and a hijacked app notification ASOS confirms customer-data exposure after attackers hijacked its app notifications. What happened, what was taken and why a stolen login can put more than contact details at risk. 12 Oct 2026 14 min https://fire-vault.com/news/asos-data-breach-customer-profiles-october-2026 ## Suggested Reading - What is Offline Secure Storage The foundation of physical disconnection: https://fire-vault.com/how-it-works/offline-secure-storage - Why Offline Secure Storage The case for physical control: https://fire-vault.com/why-oss - Ransomware Defence Hold gold copies offline: https://fire-vault.com/oss-for-ransomware-recovery - Control Physical path control for IT and OT: https://fire-vault.com/solutions/control - Knowledge Vault All articles, guides and whitepapers: https://fire-vault.com/learn/knowledge - Book a Demo See Firevault in action: https://fire-vault.com/demo Back to Knowledge Vault: https://fire-vault.com/learn/knowledge ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/news/blockchain-dead-drops-malware-surge-2026#webpage", "url": "https://fire-vault.com/news/blockchain-dead-drops-malware-surge-2026", "name": "Blockchain dead drops surge 440% as North Korea…", "description": "Chainalysis research shows malicious blockchain writes rising from 2.06 to 11.1 a day in under a year, with state-linked groups now behind most new activity.…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/news/blockchain-dead-drops-malware-surge-2026.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/news/blockchain-dead-drops-malware-surge-2026#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/news/blockchain-dead-drops-malware-surge-2026#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "Knowledge Vault", "item": "https://fire-vault.com/learn/knowledge" }, { "@type": "ListItem", "position": 4, "name": "Blockchain dead drops surge 440% as North Korea and Iran hide malware on public ledgers", "item": "https://fire-vault.com/news/blockchain-dead-drops-malware-surge-2026" } ] }, { "@context": "https://schema.org", "@type": "NewsArticle", "headline": "Blockchain dead drops surge 440% as North Korea and Iran hide malware on public ledgers", "description": "Chainalysis research shows malicious blockchain writes rising from 2.06 to 11.1 a day in under a year, with state-linked groups now behind most new activity. Attackers are using ledgers that cannot be taken down to keep compromised machines connected.", "url": "https://fire-vault.com/news/blockchain-dead-drops-malware-surge-2026", "image": [ { "@type": "ImageObject", "url": "https://fire-vault.com/news/blockchain-dead-drops-malware-surge-2026.jpg", "width": 1200, "height": 1200 }, { "@type": "ImageObject", "url": "https://fire-vault.com/news/blockchain-dead-drops-malware-surge-2026.jpg", "width": 1200, "height": 900 }, { "@type": "ImageObject", "url": "https://fire-vault.com/news/blockchain-dead-drops-malware-surge-2026.jpg", "width": 1200, "height": 675 } ], "thumbnailUrl": "https://fire-vault.com/news/blockchain-dead-drops-malware-surge-2026.jpg", "author": { "@type": "Person", "name": "Mark Fermor", "jobTitle": "CTO, CMO & Founder", "worksFor": { "@id": "https://fire-vault.com/#organization" }, "url": "https://fire-vault.com/why-oss/about" }, "publisher": { "@type": "NewsMediaOrganization", "name": "Firevault", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 600, "height": 60 } }, "datePublished": "2026-09-24T08:47:19.260814+00:00", "dateModified": "2026-09-24T08:47:19.260814+00:00", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://fire-vault.com/news/blockchain-dead-drops-malware-surge-2026" }, "inLanguage": "en-GB", "articleSection": "Threat Analysis", "wordCount": 509, "keywords": "Blockchain, Threat Analysis, data breach, cyber security, offline secure storage, data protection, physical air gap", "articleBody": "## What the research found Research published by blockchain analytics firm Chainalysis on 17 September 2026 shows a 440% year-on-year rise in what it calls blockchain dead drops (BDD). In these schemes, attackers write malware instructions, command-and-control (C2) addresses or pointers into public blockchain transactions and smart contracts, where infected devices can look them up on demand. The ", "dateline": "United Kingdom", "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ "h1", ".article-summary", "h2" ] }, "isAccessibleForFree": true, "copyrightHolder": { "@id": "https://fire-vault.com/#organization" }, "copyrightYear": 2026 }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What is a blockchain dead drop?", "acceptedAnswer": { "@type": "Answer", "text": "It is a technique where attackers store malware instructions or command server addresses inside public blockchain transactions or smart contracts. Infected devices read those records to receive new orders, and because the ledger cannot be deleted, the channel survives server takedowns." } }, { "@type": "Question", "name": "How large is the increase?", "acceptedAnswer": { "@type": "Answer", "text": "Chainalysis reports a 440% year-on-year rise, with malicious blockchain writes increasing from 2.06 to 11.1 a day in less than a year." } }, { "@type": "Question", "name": "Who is behind the activity?", "acceptedAnswer": { "@type": "Answer", "text": "Groups linked to North Korea and Iran accounted for roughly two-thirds of newly observed activity each quarter by the second quarter of 2026, according to Chainalysis." } }, { "@type": "Question", "name": "How can organisations protect their data?", "acceptedAnswer": { "@type": "Answer", "text": "Monitor for unexpected blockchain RPC traffic, and keep the most critical records physically disconnected when not in use, so that malware has no network path to them regardless of where it receives its instructions." } } ] } ] ```