A ransomware operation known as DeadLock has emerged as one of the more technically sophisticated threats of 2026, leveraging blockchain infrastructure to insulate its operations from law enforcement takedowns. Rather than relying on traditional Tor-based leak sites — which have been routinely seized by authorities — DeadLock stores its operational configuration in Polygon smart contracts, making it virtually immune to the infrastructure disruption tactics that have neutralized groups like Hive, BlackCat, and LockBit in recent years.
How the Blockchain C2 Works
Traditional ransomware operations publish victim data on Tor hidden services. Law enforcement agencies can — and routinely do — seize these servers, defacing or shutting down the leak site and disrupting the group's extortion leverage.
DeadLock's architecture routes around this entirely:
-
Smart contract as DNS — Instead of a static Tor URL, DeadLock's HTML leak page queries a Polygon blockchain smart contract at startup to retrieve the current operational proxy address. Since the Polygon blockchain is globally distributed and immutable, there is no server to seize.
-
Decentralized victim communications — Victim negotiations are conducted over the Session network, a decentralized end-to-end encrypted messaging platform. There is no central server that can be compelled to hand over communications.
-
Wasabi cloud storage for data — Exfiltrated data is staged on Wasabi S3-compatible cloud storage during the negotiation phase. Payment is demanded in Bitcoin or Monero.
The net result is an operation where law enforcement has no single point of failure to target. Even if individual affiliates are arrested, the core infrastructure continues operating.
Technical Profile
DeadLock's encryption is equally sophisticated:
| Component | Implementation |
|---|---|
| File encryption | XChaCha20 per-file |
| Key protection | Curve25519 elliptic curve cryptography |
| File extension | .dlock |
| Resource throttling | ~29% RAM / ~70% CPU (stealth-optimized) |
| Payment | Bitcoin or Monero |
The deliberate CPU and RAM throttling is notable — it is designed to avoid triggering performance alerts or user suspicion during the encryption phase, extending the window of undetected operation.
Victim Profile
As of late July 2026, DeadLock has claimed 80+ confirmed victims, primarily concentrated in Europe. Targeted sectors include:
- Information technology services
- Mining and resources
- Transportation and logistics
- Manufacturing
- Hospitality
- Consumer goods
Microsoft's threat intelligence team has attributed some DeadLock deployments to affiliates previously associated with the Lynx and INC ransomware ecosystems, suggesting a Ransomware-as-a-Service (RaaS) model with multiple affiliate groups deploying the same encryptor under the DeadLock brand.
Why This Matters for Defenders
The Polygon-based infrastructure is a meaningful evolution. Previous blockchain-adjacent ransomware tactics — such as using cryptocurrency payment addresses — were largely cosmetic. DeadLock's use of smart contracts as actual operational infrastructure (effectively using the blockchain as a C2 directory service) is a significant architectural shift.
Takedown operations won't work the same way. Law enforcement agencies have become highly effective at disrupting ransomware infrastructure by seizing hosting servers and TLS certificates. That playbook does not apply to a smart contract on a public blockchain.
Defenders should focus on:
- Pre-encryption detection — Behavioral detection for mass file reads/writes and shadow copy deletion is more important than ever when takedowns can't serve as a backstop
- Network segmentation — Limit lateral movement opportunities before an encryptor can deploy across the environment
- Backup integrity — Maintain air-gapped, immutable backups; assume Wasabi-staged data means the attacker has already completed exfiltration before encryption begins
- Endpoint visibility — Monitor for
XChaCha20encryption patterns and.dlockextension creation events
The Broader Trend
DeadLock is the latest in a series of ransomware groups experimenting with decentralized infrastructure. CanisterWorm (March 2026) used blockchain-based C2 for a self-spreading npm worm. The convergence of Web3 tooling with cybercrime infrastructure is accelerating — security teams need to understand that "seize the server" is no longer a universal solution.