According to CoinMeta, reports from Chainalysis show that attack activities using blockchain deadmailboxes to store malicious payloads have increased by 420% over the past 12 months, with the average daily number of malicious writes rising from 2.06 to 11.1. More than 15 such activities have been identified on five major public blockchains. As of the second quarter of 2026, state-backed actors accounted for two-thirds of the new activities. Among them, North Korea has been targeting crypto developers since February 2025. Entities affiliated with Iran's intelligence ministry have been using Tron, Aptos, and BSC since the end of 2024. Russian criminal groups that use Bitcoin's OP_RETURN to encode data have been operating a malware as a service model on Polygon.