State-linked hackers are increasingly using public blockchains as durable command infrastructure for malware, with North Korea- and Iran-linked groups accounting for roughly two-thirds of newly observed blockchain-dead-drop activity by the second quarter of 2026, Chainalysis said. State-linked operators represented about half of all activity tracked by the firm, up from a negligible share in early 2024. Blockchain dead drops store malware instructions, command-and-control addresses or pointers inside transactions and smart contracts, allowing infected devices to retrieve updates without being reinfected. Malicious blockchain writes rose from 2.06 a day to 11.1 after the emergence of high-capacity open-weight Chinese AI models, a 440% increase in less than a year, although Chainalysis said the data did not identify a single model or prove that AI alone caused the rise. North Korea-linked UNC5342 used TRON and Aptos as redundant routes into BNB Smart Chain, while Iran-linked operators embedded routing data in Bitcoin transactions. Russian-language criminal groups have also offered blockchain-based infrastructure through a malware-as-a-service model. The permanence of public ledgers makes takedowns difficult but gives defenders transaction histories, wallet relationships and resolver updates to monitor. RPC and API providers are likely to become key intervention points as attackers rely more heavily on public networks.