Cybercriminals and state-linked hackers are increasingly storing malware instructions, payloads and command-and-control data on public blockchains, a technique Chainalysis calls blockchain dead drops (BDDs). The firm said attacks using the method rose 420% year over year, while malicious blockchain writes increased from 2.06 per day before high-capacity, open-weight Chinese AI models emerged in mid-2025 to 11.1 per day, a 440% increase in less than a year. State-linked groups generated roughly two-thirds of new activity in the second quarter of 2026 and represented half of all activity tracked by Chainalysis. BDDs allow infected devices to read transaction data or smart contracts, then connect to off-chain systems used for credential theft, remote access or data exfiltration. A North Korea-linked campaign used Tron and Aptos as redundant paths to a BNB Smart Chain transaction containing encrypted configuration data and command-and-control addresses, forcing defenders to coordinate takedowns across three networks. Google Threat Intelligence Group separately documented North Korea-linked UNC5342 using related smart-contract techniques in fake-job-interview campaigns targeting cryptocurrency developers. Chainalysis also linked a transaction-based method to operators it suspects are connected to Iran's Ministry of Intelligence and identified Russian-language malware-as-a-service groups using Polygon. The technique does not make malware more destructive, but can preserve access to instructions after conventional servers are disrupted.