Wie Iran und Nordkorea die Blockchain für Hacks nutzen

How Iran and North Korea are using blockchain for hacks

State-sponsored hackers are increasingly relying on blockchain technology to spread their malware, according to a study by Chainalysis . They are exploiting the particular resilience of well-known blockchains.

BDDs rely on the resilience of blockchains: Unlike a centralized web server, they’re nearly impossible to knock offline. Ideal for hiding tools in a malware campaign, like instructions for a victim’s computer to communicate with HQ. The tactic’s taking off. pic.twitter.com/ujR4xcJi9Y

— Chainalysis (@chainalysis) September 17, 2026

Blockchain analysts write that hackers from two countries in particular are attracting attention through the use of this new strategy.

These are Iran and North Korea. Chainalysis also lists Russian hacking groups using the same concept in its report.

First discovered in 2023, it is a novel concept that Chainalysis calls “Blockchain Dead Drops” ( BDD for short ).

The term refers to a process in which hackers store instructions on the blockchain, which they then distribute from there.

Because they rely on decentralized networks – instead of independently operated servers as before – countermeasures are pointless. Chainalysis has already identified 15 different BDD campaigns.

“The victims’ computers retrieve the instructions from the blockchain, then establish a connection to the malware’s command center off-chain and execute its commands.”

After receiving the instructions, the victims connect to servers through which their data is intercepted, and they are remotely controlled.

Blockchains cannot be shut down even after interventions by security firms or authorities. Therefore, malware campaigns are far more persistent and long-lasting than previously possible.

State-sponsored cyberattacks (BDDs) are now particularly popular among state-sponsored cyber groups. These groups have been responsible for a full 51 percent of all BDDs since the second quarter of 2026. Independent cybercriminals are responsible for the remaining 49 percent.

“State-backed actors are refining and expanding techniques introduced by cybercriminals,” is how Chainalysis describes the development of BDD over the past few months.

Why smart contracts are particularly valuable for hackers

BDD is a broader category encompassing various specific techniques. One of these, which Chainalysis refers to as EtherHiding, involves hackers using smart contracts to protect their malware from countermeasures.

“EtherHiding is a technique where attackers store command-and-control data for malware in smart contracts on a public blockchain, allowing infected computers to retrieve their instructions from an infrastructure that cannot be seized or taken offline.”

EtherHiding is the original form of BDD, while newer methods – such as those used by Iran – deviate from smart contracts to gain further advantages.

These blockchains are popular with cybercriminals.

Chainalysis explains that different blockchains are popular depending on the group. North Korean hackers, for example, often use several crypto networks sequentially.

One incident was documented in which state hackers faked job postings for blockchain developers.

The North Koreans then planted malware on the applicants, which they established via the Tron, Aptos and BSC blockchains.

This involves a chain of commands. The hackers stored initial instructions on Tron and Aptos, which then referenced the last command on BSC.

The aim is to steal the programmers‘ private keys in order to rob them of their cryptocurrencies.

Iranian state hacking groups, on the other hand, rely on the Bitcoin blockchain . They exploit the OP_Return function.

The information stored there is linked to transactions that the Iranians are sending to blockchain addresses belonging to Bitcoin founder Satoshi Nakamoto .

For example, Russian hackers created a marketable malware service that relies on the Polygon blockchain and BSC.

Chainalysis believes it is impossible to effectively combat BDD. However, early detection is conceivable, thus preventing the infection of devices.

“For companies that have transparency regarding their endpoints, monitoring outbound JSON-RPC calls to public blockchain endpoints provides a scalable early warning signal,” it says.

The proliferation of uncensored, open-source Chinese artificial intelligences has accelerated the spread of BDD, as they can be used for its development.

“Since the introduction of high-capacity Chinese open-source AI models that impose no restrictions on generating malicious code, BDDs have skyrocketed by 440 percent.”