Signal
DeadLock ransomware reportedly uses polygon smart contracts to support negotiations
Evidence first: scan the strongest sources, then decide whether to go deeper.
Published 2026-01-14 14:16 UTCUpdated 2026-01-14 18:08 UTC
rss
ransomwareextortionthreat_actor_tradecraftblockchainsmart_contractspolygon
Source links open
Source links and full evidence are open here. Archive history, compare-over-time, alerts, exports, API, integrations, and workflow are paid.
No card needed for the free brief.
Evidence trail (top sources)
top sources (2 domains)domains are deduped. counts indicate coverage, not truth.2 top sources shown
limited source diversity in top sources
Overview
A newly emerged ransomware operation, DeadLock, is being tracked for adopting blockchain-native tradecraft. Reporting highlights the group’s use of Polygon smart contracts to publish or store infrastructure pointers (such as proxy server addresses) that support victim communications and negotiations, while complicating defenders’ efforts to analyze and disrupt the operation.
Score total
0.86
Momentum 24h
2
Posts
2
Origins
2
Source types
1
Duplicate ratio
0%
Why now
- DeadLock is described as newly emerged, drawing early scrutiny of its methods.
- Researchers are flagging blockchain-based anti-detection techniques in current reporting.
Why it matters
- Smart-contract-based pointers can make takedown and attribution efforts harder.
- Blockchain-native tradecraft may shift how defenders monitor negotiation infrastructure.
- Highlights continued evolution in ransomware operational security techniques.
LLM analysis
Topic mix: lowPromo risk: lowSource quality: medium
Recurring claims
- DeadLock is using Polygon smart contracts as part of its ransomware negotiation/communications workflow.
- Researchers describe the approach as an anti-detection method intended to hinder defenders’ analysis of the group’s infrastructure and tradecraft.
How sources frame it
- BankInfoSecurity: neutral
- The Register: neutral
Two outlets describe the same tactic: DeadLock using Polygon smart contracts to support ransomware negotiations and evade analysis.
All evidence
All evidence
DeadLock Ransomware Group Utilizes Polygon Smart Contracts
BankInfoSecurity · bankinfosecurity.com · 2026-01-14 18:08 UTC
'Imagination the limit': DeadLock ransomware gang using smart contracts to hide their work
theregister_security · go.theregister.com · 2026-01-14 14:16 UTC
Show filters & breakdown
Posts loaded: 0Publishers: 2Origin domains: 2Duplicates: -
Showing 2 / 0
Top publishers (this list)
- BankInfoSecurity (1)
- theregister_security (1)
Top origin domains (this list)
- bankinfosecurity.com (1)
- go.theregister.com (1)