TLDR Tech / InfoSec
Blockchain Dead Drop Resolvers Explained
Researchers identified multiple malware families abusing smart contracts on EVM, Solana, and TON blockchains as "dead drop resolvers" to dynamically fetch command-and-control addresses. By utilizing read-only functions like eth_call, threat actors can cheaply rotate infrastructure without altering their core payloads, a tactic recently deployed in the August 2026 ChainDrop npm supply-chain compromise. To detect this evasion technique, defenders should monitor for non-browser processes like node, bun, or curl making anomalous RPC queries to public providers and correlate the decoded responses.
Read the full story