State-linked cybercriminals are increasingly using public blockchains as “dead drops” for malware instructions and infrastructure details, according to a new Chainalysis report. The firm estimates that state-aligned actors accounted for roughly two-thirds of new dead drop activity each quarter, while the frequency of these writes rose 420% over the past 12 months.

Chainalysis also reports that operators tied to North Korea and Iran are among the groups adopting the tactic, including activity it linked across multiple networks—Tron, Aptos, and BNB Smart Chain (BSC)—to a North Korea-associated actor tracked by Google Threat Intelligence.

Key takeaways

• Chainalysis says state-linked threat actors drive about two-thirds of quarterly blockchain dead drop activity.
• Blockchain “dead drop” writes climbed 420% year over year, indicating faster growth in on-chain malware infrastructure.
• North Korea-linked groups have used multi-chain routing, with Tron acting as a first route and Aptos as a fallback to a BSC transaction containing encrypted instructions.
• Chainalysis attributes a 440% rise in malicious writes since July 2025 in part to the availability of high-capacity open-source AI models capable of generating malicious code with limited safeguards.
• Iran-linked operators are also suspected of using the Bitcoin blockchain to publish encoded command-and-control routing data that infected devices can poll for updates.

Dead drops across public chains: why it’s hard to shut down

Chainalysis defines the “dead drop” tactic as embedding malware guidance—such as pointers to infrastructure, server addresses, or configuration data—inside transactions on public blockchains. The report highlights a central advantage for attackers: even if domains, servers, or code repositories are taken offline, the stored information can remain publicly accessible on-chain.

The analytics firm warns that this durability makes campaigns more resilient over time and increases the operational burden on defenders. Instead of merely disrupting a single server or endpoint, response efforts may need to account for information that is permanently replicated across decentralized ledgers.

Chainalysis also points to a broader pattern: state actors are not only using blockchains, but increasingly scaling how often they do so and broadening the networks involved.

North Korea-linked activity routed through Tron, Aptos, and BSC

One of the report’s most specific findings ties previously unattributed blockchain activity spanning Tron, Aptos, and BNB Smart Chain to UNC5342, a North Korea-linked group tracked by Google Threat Intelligence.

Chainalysis describes how encoded pointers embedded in Tron and Aptos transactions would direct infected devices toward the same BSC transaction. In this setup, Tron served as the first routing path, while Aptos provided a fallback option if the primary route failed.

The shared BSC transaction, Chainalysis says, contained encrypted server addresses and configuration data. That data, once decrypted by compromised devices, connected them to off-chain infrastructure used for remote access and data theft.

For investors and builders, the takeaway is less about any single chain and more about how malware operators are treating blockchain networks as flexible, multi-route messaging systems—one that can help keep campaigns functioning even when certain routes or infrastructure components change.

Chainalysis also notes that public blockchains have previously been used in similar ways by North Korean hackers. In 2025, for instance, coverage from Cointelegraph described a technique called EtherHiding, where malicious crypto-stealing code was placed in smart contracts.

AI’s role: more malicious writes, but attribution remains uncertain

Chainalysis further reports a 440% increase in malicious blockchain writes since July 2025, framing the change as coinciding with when “high-capacity open-source Chinese artificial intelligence models became capable of producing malicious code with limited safeguards,” according to the firm’s findings.

Eric Jardine, cybercrimes research lead at Chainalysis, told Cointelegraph that the team observed a “clear point-in-time association” between the period and the surge in malicious on-chain activity. However, he cautioned that the firm could not prove that the actors publishing the malicious transactions and contracts had directly used these AI models to boost their output.

This distinction matters for what readers should infer from the data. The increase suggests that the environment for writing and deploying malicious code may have become easier to scale, but Chainalysis’ evidence does not establish a direct line from a specific model to specific actors. Defenders may still adjust their priorities—especially around how quickly adversaries can publish new payloads—without assuming the attribution is solved.

Iran-linked operations use Bitcoin as an update channel

Beyond non-Bitcoin networks, Chainalysis also identifies threat actors it suspects are linked to Iran’s Ministry of Intelligence. In its assessment, those actors wrote encoded command-and-control routing data to the Bitcoin blockchain.

Chainalysis says its judgment is based on a combination of factors—such as the malware family, the decoding method used, timing patterns, and associated server infrastructure—rather than relying on blockchain activity alone.

The report describes a mechanism where attacker-controlled wallets sent small payments to a well-known Bitcoin address historically tied to Satoshi Nakamoto. Chainalysis states that the address has no connection to the attackers and functions as a permanent public location that infected devices can check for updated instructions.

According to Chainalysis, the attackers can refresh their server infrastructure by publishing a new Bitcoin transaction with updated data. Once malware pulls the new directions, the operation can shift off-chain for follow-on activities that may include remote access, credential theft, and the delivery of additional malware.

By using Bitcoin as a reliable public registry for routing updates, the approach again underscores the same theme: attackers can avoid some traditional single-point failures (like takedowns) by embedding “where to go next” information into data that remains widely available.

Chainalysis’ findings suggest defenders should treat blockchain dead drops as an evolving, potentially scalable part of cyber operations—especially as on-chain writes rise across multiple networks. The key uncertainty readers should watch next is whether future reporting will narrow the gap between association and direct attribution—particularly around AI-assisted scaling—and how quickly defenders and platforms adapt to this more resilient style of malware infrastructure.

Stablecoin payments firm dtcpay announced today the formal completion of its $25 million Series A funding round, securing a strategic investment from Japan’s financial giant, the SBI Group.

The capital raise, initially anchored earlier this year by Vertex Ventures Southeast Asia & India, concluded with SBI entering the fold through SBI Ventures Asset and the SBI-NTU-Kyobo Digital Innovation Fund. Existing backers Genedant Capital and Kwee Liong Tek also maintained their positions.

Dtcpay provides essential crypto infrastructure. It handles asset conversion and custody, and offers a Visa-linked card that lets holders spend stablecoins just like ordinary cash. The firm holds a Major Payment Institution license from the Monetary Authority of Singapore, alongside regulatory footprints in Europe, Hong Kong, Australia, and North America.

SBI’s involvement in the funding round indicates a strategic move to secure fully regulated pipelines connecting Japanese capital with Southeast Asian commercial channels. Stablecoins provide a high-speed alternative to slow traditional correspondent banking, provided the intermediary meets rigorous regulatory standards.

“We did not raise this round to sustain what we have built,” Alice Liu, founder and CEO of dtcpay, said in the statement. “We raised it to fundamentally change how money moves across borders.”

Hong Kong has set plans to bring 24/7 central bank digital currency settlement to its tokenized deposit market by around the end of 2026, while preparing real value CBDC transactions for after hours derivatives trading and tests involving more than HK$1.3 trillion in Exchange Fund Bills.

According to Hong Kong’s 2026 Policy Address, the Hong Kong Monetary Authority plans to implement CBDC settlement and round the clock operations under EnsembleTX, the pilot phase of Project Ensemble, while continuing to explore new uses for tokenized deposits.

The plan would give banks access to tokenized central bank money for settlement beyond the operating hours of conventional payment infrastructure. EnsembleTX has been running real value transactions involving digital assets and tokenized deposits during 2026, with the HKMA progressively upgrading the pilot environment to support 24/7 settlement in tokenized central bank money.

Hong Kong began the live transaction phase after earlier Project Ensemble work examined how tokenized commercial bank deposits could be used alongside tokenized assets. Interbank settlement initially remained dependent on conventional payment infrastructure, leaving a gap between the continuous operation of distributed ledger systems and the hours during which central bank money could move between banks.

Hong Kong CBDC plan moves toward 24/7 settlement

The year end target moves EnsembleTX closer to providing both the tokenized commercial bank money used by participating institutions and a central bank settlement asset for transactions between them.

As crypto.news previously reported, Hong Kong’s latest policy program includes plans to support regulated stablecoin trading on licensed virtual asset platforms and use regulated stablecoins to settle tokenized money market funds. The Securities and Futures Commission is expected to refine rules for tokenized investment products, including gold and other suitable real world assets.

CBDC settlement under EnsembleTX serves a separate part of the tokenized financial system. Tokenized deposits represent commercial bank money, while the wholesale CBDC provides central bank money that can be used for settlement between participating financial institutions.

The HKMA said in its 2025 annual report that EnsembleTX would operate throughout 2026 and that its pilot environment would be progressively enhanced to support settlement in tokenized central bank money on a 24/7 basis.

Earlier e-HKD trials provided the groundwork. The HKMA completed the second phase of its digital currency pilot in 2025 after 11 projects tested e-HKD and tokenized deposits across financial use cases. The pilot findings indicated that both forms of digital money could support programmable transactions, after which the authority prioritized wholesale financial applications.

Wholesale CBDC will enter after hours derivatives settlement

A second use of wholesale e-HKD is being prepared with Hong Kong Exchanges and Clearing for derivatives trading outside normal banking hours.

HKEX and the HKMA are working to introduce a wholesale CBDC payment solution for after hours derivatives trading, with real value transactions targeted for 2026, according to the Policy Address.

The two institutions had already started an after hours CBDC pilot in June. The trial examines whether clearing participants can use e-HKD to transfer advance margin outside regular banking hours.

Under the existing process described when the pilot was announced, clearing participants seeking to have advance margin recognized for an after hours trading session have to submit deposit requests to HKFE Clearing Corporation by 3 p.m. The pilot allows participating firms to test real value transactions voluntarily, while any larger rollout remains subject to regulatory approval and market readiness.

HKEX Chief Operating Officer Vanessa Lau said at the time that the project was intended to provide a “more flexible and timely payment option” outside regular business hours. HKMA Deputy Chief Executive Howard Lee described the project as a test of wholesale CBDC in a live market environment.

HKMA will test more than HK$1.3 trillion in Exchange Fund Bills

Hong Kong’s tokenization plans extend beyond payments. The HKMA is preparing tests involving more than HK$1.3 trillion worth of Exchange Fund Bills before the end of 2026.

The Policy Address said the tests will examine the operation of tokenized Exchange Fund Bills and how banks can use the instruments around the clock for asset and liability management. The HK$1.3 trillion figure refers to the value of Exchange Fund Bills that could be used more efficiently through tokenization, rather than a statement that the entire amount will be tokenized in a single issuance.

That distinction clarifies an ambiguity in earlier information describing the initiative as an HK$1.3 trillion tokenization test. The Policy Address describes tests on the operation of tokenization involving a pool of more than HK$1.3 trillion worth of Exchange Fund Bills.

Hong Kong has already moved government and institutional debt onto digital infrastructure. The HKMA formed a tokenized bond expert group in June involving JPMorgan, HSBC, Standard Chartered, UBS, Ant Digital, HashKey Group and other institutions. At that point, Hong Kong had issued more than HK$6.8 billion in tokenized government bonds across several offerings.

Later that month, Hong Kong Mortgage Corporation priced an HK$12 billion digital bond, which it described as the world’s largest digital bond issuance. Orders reached roughly HK$24 billion from more than 100 institutional accounts in Hong Kong, mainland China and overseas markets.

The 2026 Policy Address said digital bonds issued in Hong Kong accounted for nearly 50% of the global market between 2025 and the first half of 2026. Authorities now plan to regularize digital bond issuance while examining the use of digital currencies across settlement, dividend payments and redemption.

Stablecoins are being brought into tokenized fund settlement

Regulated stablecoins are being developed as another settlement route within Hong Kong’s digital asset framework.

The government plans to promote their use for settling tokenized money market funds, while allowing regulated stablecoins to trade on licensed virtual asset platforms.

Hong Kong already has a live institutional example. Anchorpoint Financial began the phased rollout of HKDAP in August, giving institutional distributors and professional investors access to the Hong Kong dollar backed stablecoin for payments, fiat conversion and tokenized asset settlement.

Standard Chartered subsequently became HKDAP’s first bank distributor. The bank plans to introduce subscription and settlement services for tokenized money market funds during the fourth quarter of 2026 and work with international and Hong Kong asset managers.

Hong Kong’s Stablecoins Ordinance has been in force since Aug. 1, 2025, establishing HKMA licensing requirements covering reserve assets, redemption, governance, risk management and anti money laundering controls. Anchorpoint received an issuer license in April 2026 before moving HKDAP into live testing and its phased institutional rollout.

Meanwhile, the HKMA plans to keep expanding tokenized deposit applications beyond domestic financial markets. Hong Kong’s Policy Address said the authority will work with mainland China on trade finance use cases, with pilot transactions scheduled to be completed by the end of 2026.

Cointelegraph is committed to providing independent, high-quality journalism across the crypto, blockchain, AI, and fintech industries.

All news, reviews, and analyses are produced with full journalistic independence and integrity. For more details on our standards and processes, please read our Editorial Policy.

James Check, founder and lead analyst at Checkonchain, said Bitcoin may have already established its cycle bottom after undergoing two capitulation events, arguing that shifts in holder behavior indicate the market has absorbed much of its selling pressure.

Bitcoin (BTC) reached a record of just over $126,000 in October 2025 and traded around $77,400 at the time of writing, nearly 39% below its peak. Some traders expect BTC to establish another low in October 2026 based on its historical four-year cycle. In July, analyst Benjamin Cowen said that cycle-duration data and the US midterm-election calendar pointed toward a fourth-quarter bottoming window.

In an interview on Cointelegraph’s Proof of Thesis show, Check described Bitcoin’s February decline toward $60,000 as a “price-pain capitulation,” when investors who bought near the top sold at substantial losses. He identified a second “time-pain capitulation” around $58,000 in June and July, following months of sideways price action that caused holders to question whether Bitcoin would recover. 

“What’s the difference between $58,000 and $59,000 or $60,000? Nothing,” Check told Cointelegraph. “It’s the six months that separated them. That’s the actual difference.” His assessment challenges expectations of an October low, suggesting the capitulation signals associated with a bear-market bottom appeared months earlier.

Check said approximately $300 billion in Bitcoin cost basis was concentrated between $58,000 and $70,000, while about 4 million BTC moved from an unrealized loss into profit during the subsequent recovery. He added that long-term holders now control roughly 80% of Bitcoin wealth and are more likely to wait for substantially higher prices than sell after a short-term rebound. 

Bitcoin four-year cycle misleads traders

Check said anchoring to the four-year cycle is a mistake because there is no mechanical reason for it to repeat.

“Ask, ‘Well, now what do I do?’ long before your compass breaks,” Check told Cointelegraph. “It’s like a broken clock. It’s right twice a day. Just assume it’s broken and find something better.”

Check said previous cycle dates do not explain why investors capitulate. He said traders should instead examine cost basis, unrealized and realized losses, holder profitability and whether experienced investors are accumulating or distributing their coins. 

He said that calendar dates should only provide context after evidence of market exhaustion or capitulation emerges. “Look for the evidence, not the calendar,” Check said.

Related: Bitcoin treasuries buy just 5.9K BTC in three months as paper losses linger

Grayscale researcher also sees $58,000 bottom

Grayscale head of research Zach Pandl reached a similar conclusion in a recent interview on Cointelegraph’s Trade Secrets. “I’m willing to stick my neck out and make a guess that prices bottomed back at $58,000 at the end of June,” Pandl told Cointelegraph. 

Pandl said the downturn produced less despair than previous Bitcoin bear markets but followed a bull market that also generated less euphoria, potentially resulting in a more contained decline. 

He also pointed to Bitcoin’s ability to withstand adverse developments without continuing to fall. “When price in an asset class, whether it’s crypto or anything else, stops going down on bad news, that’s usually a sign that it’s oversold,” Pandl said.

Onchain evidence remains mixed. HODL Waves data showed that Bitcoin supply held for one to seven days rose only from 1.97% on July 1 to 2.35% on July 5, which analyst Willy Woo interpreted as an unusually muted response from dip-buyers.

However, CryptoQuant data showed that short-term holders had remained partially profitable for 30 consecutive days, the longest such stretch of 2026 and a pattern the analytics firm said has characterized previous Bitcoin market recoveries.

Magazine: Bitcoin treasury firms can outperform BTC… but is the risk worth taking?