Blockchain C2 is a command-and-control method that uses blockchain infrastructure to publish or retrieve instructions, configuration data, or other small control messages for malware. Instead of relying only on a fixed server or domain, an operator may store references in blockchain transactions, smart contracts, or related metadata that the infected host can read and act on.
This matters because blockchain records are distributed, hard to tamper with, and often difficult to block without affecting legitimate traffic. That can make takedown and sinkholing slower, and it gives attackers a more resilient control channel. In real attacks, blockchain C2 is often used to fetch the next stage, rotate addresses, or update payload settings. Defenders look for unusual blockchain queries from user systems, suspicious wallet or contract interactions, and malware that pairs blockchain reads with encrypted local execution logic.