Chains They Can't Seize: How Ransomware Turned the Blockchain Into a Hideout

Ransomware is no longer just about encrypting files and collecting cryptocurrency. Attackers are increasingly experimenting with blockchain as infrastructure — building a control and recovery layer that may have no conventional server, domain, or provider for defenders to seize.

On February 20, 2024, computer screens across the ransomware underground went dark. British and American investigators had spent months inside LockBit's systems before finally seizing them, freezing more than 200 cryptocurrency accounts linked to the group and replacing its leak site with a law-enforcement banner. Operation Cronos looked, for a moment, like the end of one of the world's most damaging ransomware operations.

It wasn't.

Within days, LockBit was back. A new leak site appeared on the same dark-web network. New victims were claimed. The operators even admitted that part of the disruption had happened because they had left a PHP vulnerability unpatched.

The episode captured something important about modern ransomware: taking down a criminal brand does not necessarily take down the ecosystem behind it. The people, money, access, infrastructure and know-how can move.

Now there is another layer to that problem. Ransomware actors are learning to use blockchain not only to move the money they extort, but also to make parts of their attack infrastructure remarkably difficult to remove.

When people hear "ransomware and cryptocurrency," they usually think about payment. A victim pays in crypto; the attacker then tries to move the funds through wallets, services, bridges and exchanges until the connection to the original payment becomes harder to follow.

That problem is already difficult. But the newer development is more unsettling: attackers can use blockchain itself as part of the malware infrastructure.

Instead of hosting every component on a server controlled by the attacker, malware can query a smart contract for information. A blockchain transaction or contract call becomes a kind of lookup mechanism. The code can remain available even when the attacker loses a conventional server.

The distinction matters. A server can be seized. A domain can be suspended. A hosting account can be terminated. A decentralized blockchain record is a very different target.

The financial side of ransomware is evolving quickly. Chainalysis estimated that ransomware victims paid about $820 million on-chain in 2025 — an 8 percent decline from the previous year — even as the number of claimed attacks rose by roughly half.

Only about 28 percent of victims paid, but the payments that did happen were larger. The median ransom reportedly jumped from $12,738 to $59,556 in a single year. That tells a broader story: ransomware operators are increasingly interested in targets capable of paying meaningful amounts, while defenders have become better at refusing payment.

The laundering side is changing too. Traditional cryptocurrency mixers became less prominent in 2025, with mixer-related laundering activity falling 37 percent. Cross-chain bridges, meanwhile, saw a 66 percent increase in laundering-related use.

Akira provides a useful example. TRM Labs reported roughly $150 million in extorted payments associated with the group in 2025. Investigators observed the laundering setup change repeatedly over roughly two years — from WanChain, to Defiway, to intermediary wallets and eventually consolidation for cash-out.

The lesson is uncomfortable but straightforward: when defenders learn one financial pattern, criminal operators can change the pattern. The defensive challenge is no longer simply "Can we identify the wallet?" It is "Can we recognize the behavior as the money moves through a changing ecosystem?"

Sometimes the infrastructure criminals depend on becomes important enough to attract its own law-enforcement attention.

In June 2026, Europol dismantled a service investigators called AudiA6. According to reporting cited in the original research, the operation had processed more than €336 million since 2021 through thousands of fraudulent exchange accounts opened with stolen identities. Investigators described it as a hub supporting ransomware actors and linked it to more than 15 separate ransomware investigations.

This is why infrastructure-focused disruption can matter more than chasing a single ransomware name. Remove one affiliate and another may appear. Remove a shared financial or hosting service used by many groups, and the disruption can spread across the ecosystem.

The more significant shift is not where ransomware money goes. It is where attackers put the instructions.

Researchers have tracked a technique known as EtherHiding in which compromised legitimate websites use blockchain smart contracts to retrieve malicious content. In the campaigns described by Trend Micro, the browser effectively asks a smart contract what to retrieve next.

The mechanics are deceptively simple. Malicious payload data can be stored in the contract's on-chain storage. A browser retrieves it through an ordinary blockchain read request. The payload can then make decisions about the victim's environment and deliver the next stage of the attack.

The important detail is what is missing: there is no conventional server hosting the malicious data. The information is replicated as part of the blockchain infrastructure itself. That changes the defender's problem. There may be no server to seize, no hosting provider to contact and no single copy of the malicious content to delete.

In August 2026, Microsoft researchers described another striking example: DeadLock. DeadLock uses smart contracts on the Polygon blockchain to store its live proxy address and operator blog content. A victim's recovery environment can query the blockchain to discover where it should connect.

If defenders take down the proxy, the operators can update the smart contract. The next time a victim checks, the recovery infrastructure can point somewhere new. That creates a fundamentally different resilience model. The domain is not the source of truth. The blockchain is.

Since its appearance in July 2025, DeadLock had reportedly affected more than 80 organizations across four continents, with 75 new victims posted in June 2026 alone. The campaign also used additional defensive-evasion techniques, including a vulnerable-driver approach to interfere with endpoint security and deletion of Windows event logs.

The important question is no longer only "Where is the attacker's server?" It becomes "What behavior does the malware exhibit when it receives its next instruction?"

DeadLock is not the only example. Unit 42 researchers tracked Aeternum, a botnet loader that uses Polygon smart contracts as a decentralized dead drop. In the reported setup, infected machines call a contract function to retrieve their instructions, while operators can update the destination through another function.

Aeternum is particularly significant because it lowers the barrier to entry. The reported service was offered as a point-and-click criminal tool for around $200 and had accumulated more than 29,000 detection events by June.

Other researchers also observed EtherRAT using Ethereum for a similar purpose. The underlying technique is therefore not tied to one ransomware group or one blockchain. Once a capability becomes cheap, reusable and available across multiple criminal services, it stops being an interesting experiment and starts becoming infrastructure.

The technique has also crossed into state-sponsored activity. Google Threat Intelligence Group reported the first known state-sponsored use of EtherHiding by the North Korean group tracked as UNC5342. The campaign built on a fake-job-interview operation aimed at software developers in cryptocurrency and technology sectors.

The infection chain described in the research used a downloader that queried blockchain infrastructure for instructions, followed by an information stealer and a backdoor. The infrastructure was split across BNB Smart Chain and Ethereum, and the on-chain instructions were updated repeatedly.

The significance goes beyond one group. It demonstrates that blockchain-mediated command infrastructure can be useful wherever an operator values resilience, flexibility and resistance to conventional infrastructure takedowns.

Yes. But their purpose is changing.

Operation Cronos genuinely damaged LockBit. Its credibility with affiliates suffered, and the group did not simply return to its previous position. Similar patterns have appeared elsewhere: when a major ransomware operation collapses, its people and capabilities can scatter into successor groups.

The lesson is not that law enforcement cannot win. It is that the target is becoming more distributed. Going after shared infrastructure can therefore produce stronger effects. The AudiA6 disruption affected an ecosystem serving multiple ransomware investigations rather than a single criminal brand.

The same principle applies to financial intelligence. Modern blockchain analytics can trace activity across wallets, bridges and decentralized exchanges, identify behavioral patterns and help investigators move faster.

If blockchain-based infrastructure cannot always be seized, organizations have to change where they place their defensive emphasis.

• Endpoint behavior matters more. If malware retrieves instructions from decentralized infrastructure, defenders should focus on what happens on the machine: unusual scripting, suspicious command execution, browser-to-shell transitions, credential theft, tampering with security software and other indicators of compromise.
• Logging becomes critical. Microsoft guidance following EtherHiding emphasized stronger controls around command-line execution, deeper visibility into scripting engines and treating suspicious copy-and-paste behavior from web pages as a potentially serious compromise signal.
• Financial intelligence should become part of incident response when ransomware payments are involved. Wallet movements, bridges, intermediary wallets and transaction timing can reveal behavioral fingerprints even when infrastructure changes.
• Security teams should think in ecosystems. The most valuable disruption target may not be the ransomware brand on today's headline. It may be the provider, service or infrastructure layer that several criminal groups rely on.

For years, much of cybersecurity's disruption playbook assumed that the internet had owners. Find the server. Seize the server. Find the domain. Suspend the domain. Find the hosting provider. Shut down the account.

Those actions still matter. But blockchain-based infrastructure introduces an internet layer where there may be no single owner, no single server and no single switch to turn off. That does not make ransomware unstoppable. It changes where defenders have to look.

The battlefield is moving toward the edges: the endpoint, the user's decision, the malware's behavior, the wallet's movement and the ecosystem of services that keeps the operation alive.

LockBit returned in a week. DeadLock never needed a conventional server to begin with. Somewhere between those two facts is the honest state of ransomware in 2026: it is still vulnerable to disruption, but increasingly designed to survive it.

• ReversingLabs — Operation Cronos and the LockBit takedown: What we know
• Field Effect — LockBit ransomware group back after global takedown operation
• Chainalysis — Crypto Ransomware: 2026 Crypto Crime Report
• TRM Labs — 2026 Crypto Crime Report
• The Hacker News — Europol Disrupts AudiA6 Crypto Laundering Service Used by Ransomware Gangs
• Chainalysis — Crypto Sanctions: 2026 Crypto Crime Report
• Trend Micro — Smart Contracts for Command and Control: How ClearFake Hid in Plain Sight on BSC Testnet
• Microsoft Security Blog — DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure
• Google Cloud / Google Threat Intelligence Group — DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains