Chainalysis: Blockchain "dead letterbox" attacks increased by 420% in 12 months

According to a report by Chainalysis, the method of storing malicious payloads or C2 configurations in on-chain transactions and smart contracts, referred to as "blockchain dead letter box," has increased by approximately 420% over the past 12 months. The average daily malicious writes have risen from 2.06 to 11.1, with over 15 active instances identified across five major public blockchains.

As of the second quarter of 2026, state-backed actors account for about two-thirds of the new activities: North Korea's UNC5342 has been targeting cryptocurrency developers with fake recruitment since February 2025, redundantly using TRON, Aptos, and BSC; entities linked to the Iranian Ministry of Intelligence have been encoding data using Bitcoin OP_RETURN since the end of 2024; and Russian criminal groups are operating on Polygon in a malware-as-a-service model.