Remy Blaire: Well, cybercriminals have found a new hiding place that no one can erase, and that is public blockchains.
Hackers are now using blockchains as permanent, undefeatable digital mailboxes to store malware instructions, a technique known as blockchain dead drops.
A report from Chainalysis is showing a 440% surge in these on-chain attacks over the past year, and they have been fueled by unrestricted AI models, which lower the barrier to entry.
And with nation-states like North Korea as well as Iran weaponizing this tradecraft, defenders are facing a tough dilemma.
So how do you actually stop a cyberattack when you can't necessarily press delete?
Well, joining us live to break down the threat and also the defensive playbook is Eric Jardine, Cybercrimes Research Lead at Chainalysis.
Eric, good afternoon. Thank you so much for joining us.
So for viewers out there, tell us about this dead drop. It does sound as though it could be an old Cold War spy novel, but it is happening on-chain.
So can you explain exactly what this is and why hackers are choosing these blockchains over, say, traditional web servers?
Eric Jardine: Absolutely. Thanks for having me on to talk about this.
So blockchain dead drops are, in essence, a way of storing command-and-control infrastructure on the blockchain.
So this makes it immutable, as you mentioned, preventing traditional cyber threat intelligence firms from taking down the infrastructure that bad actors use to coordinate their campaigns.
And so we've seen a migration in this direction that's been sort of a long time coming. And it's partially anchored in the effectiveness of traditional takedown efforts on Web2, where command-and-control infrastructure and malicious websites and things of that nature can be removed.
And the equivalent does not apply on-chain, as you know.
Remy Blaire: Yeah. And while I have you here, I do want to get your take on artificial intelligence.
So we have been hearing about what AI is actually capable of. So how does this actually lower the skill barrier for weaker operators who want to launch these attacks?
Eric Jardine: Right. So as you mentioned in the beginning, we saw a rapid surge in writes to the blockchain associated with these blockchain dead drops.
And that comes at an inflection point where open-source models like M2 and Qwen3 reached a certain capacity threshold, allowing them to do effectively agentic forms of coding.
And so what this tends to imply is basically actors who, for instance, wouldn't be able to use the blockchain to coordinate their command-and-control infrastructure would be able to write in Solidity or Rust or other languages that would allow them to do this.
So that would be one form of entry where the barrier has been reduced through AI models.
And then you also have, I think, a pretty clear trend here where you just get, like, a capacity boost.
So people like the DPRK threat actor behind Contagious Interview, for example, they would be able to do this regardless of whether or not they had AI.
But AI would provide a speed boost, and so they're able to rotate their infrastructure faster and provide additional malicious endpoint pointers and things like that.
And so we end up with two sort of forms where AI would be bolstering the use of this sort of malicious attack vector.
Remy Blaire: Yeah. And of course, we do have to think about national security here, especially when we're talking about artificial intelligence and these types of hacks.
So state-linked groups are now accounting for about half of all these dead drop activities, and they are able to weave encoded instructions across chains.
So tell us why exactly these heavyweight nation-state actors are adopting this, and tell us what they are actually targeting.
Eric Jardine: So the reason why is due to the persistence of the infrastructure.
So if you're running the exact equivalent infrastructure, but on Web2, that's prone to disruptions that will, by extension, disrupt any kind of malicious campaign that's underway.
Those campaigns, we have seen throughout history, they do regenerate. That is sort of like a hallmark of the space.
But when leveraging Web3 and blockchain in order to do the command-and-control infrastructure, the pointer nodes and these sorts of things, that provides a persistence that allows for a continuity of operations.
And that, from a state actor perspective, is quite advantageous.
And so that kind of acts as, like, a proof of concept for bad actors in the space.
We see, for example, with Contagious Interview, which is a DPRK threat actor. They were targeting individuals using this technique.
So they were behind the sort of Zoom downloads of malicious content that would then relay and communicate with the blockchain that would then end up stealing crypto.
But it's one form of a broader pattern.
So you could be targeting individuals, you could target high-placed individuals, you could target large numbers of individuals, all again referencing the on-chain command-and-control infrastructure and malicious payloads that are stored on the blockchain.
Remy Blaire: And Eric, while I have you here, I do want to zoom out and talk about the very selling point of what blockchain is. And this is precisely what the hackers are exploiting.
So can you walk us through why defenders can't simply take down or delete some of this malicious data? And why is protocol censorship the wrong answer?
Eric Jardine: Well, that is the challenge.
The immutability of blockchain is part of the selling feature of the whole technology.
What that means in practice is basically that a transaction, once written, for example, is not subject to change and that the computational burden to change it would be insurmountable.
Taking advantage of that, we see bad actors basically deploying this command-and-control infrastructure on-chain, and there isn't a pragmatic way to truly censor this.
Instead, you have to move to sort of preventive monitoring.
So if a device is communicating with an RPC endpoint that references on-chain data, and it's not supposed to be, that's a telltale sign that something potentially linked to these actors might be underway.
So there are still steps that can be taken, but they're certainly not in the realm of censorship and takedown.
Remy Blaire: Yeah. And finally, before I let you go, we have about 60 seconds here.
So you mentioned pragmatic controls as well as RPC monitoring.
So what should enterprises actually keep in mind, as well as deploy right now, to catch these attacks before anything happens?
Eric Jardine: Well, I think that the biggest-picture point here is that the blockchain is becoming this command-and-control infrastructure.
And we're seeing this happen in the malicious space in this case, but this is, like, a broader point about just the migration of technology across multiple sectors, where the blockchain is becoming that foundational infrastructure.
In this case, of bad actors, but we see it with more positive use cases too.
And so that means that, like, ignoring the on-chain dimension in favor of, like, a persistent Web2 focus is not the right answer.
Remy Blaire: Well, Eric, I appreciate your time today. Thank you so much for joining us on this Friday afternoon.
Thank you so much for all of your insights as well as your perspective. Have a great weekend.
Eric Jardine: Thanks for having me. Bye-bye.
