A blockchain dead drop is a malware technique where an infected program reads configuration, next-step destinations, or other pointer data from a public blockchain. The blockchain acts like a shared bulletin board: anyone can publish data, and the malware later retrieves it to learn where to connect or what to do next.
This matters because it makes attacker infrastructure harder to disrupt than a single hardcoded server or domain. Defenders can block known IPs, take down domains, or sinkhole fixed C2 hosts, but a public blockchain is distributed and tamper-resistant. In real attacks, this pattern is often used as a resolver layer for command-and-control, reducing the need for static network indicators. Security teams look for unusual blockchain RPC traffic from endpoints that do not normally use it, rapid lookup behavior after execution, and loaders that fetch configuration dynamically. Monitoring and blocking suspicious blockchain access can help break the chain before the malware reaches its next stage.