Cyber attackers are increasingly storing malware command-and-control information on public blockchains, a technique Chainalysis calls Blockchain Dead Drops, or BDDs. Rather than compromising Bitcoin, Ethereum, BNB Chain, Tron or another network, attackers use blockchains’ public and persistent data layer. Malware can retrieve configuration data, addresses or pointers from transactions or smart contract state (stored blockchain program data), allowing criminals to alter instructions without relying on a conventional server or domain that defenders can seize, block or disrupt. Chainalysis describes the broader method as EtherHiding and says malicious on-chain writes have risen about 440% since mid-2025. Its research links different versions of the technique to actors associated with North Korea and Iran, as well as financially motivated Russian-language cybercrime groups. The attribution comes from Chainalysis’ own research. The development means blockchain monitoring for crypto infrastructure operators, wallet providers and security teams must cover potential malware infrastructure in addition to stolen funds and suspicious transfers. The underlying cryptography of the named networks has not been broken; attackers are exploiting their intended ability to preserve publicly verifiable data.