A blockchain resolver is a technique for looking up command-and-control (C2) data from a blockchain network instead of a normal web server or DNS record. Malware may read transactions, smart-contract storage, or on-chain metadata to recover an address, domain, or next-stage payload location. In some designs, operators can update that on-chain data over time, making the malware's control path harder to block or take down.
This matters because defenders cannot always rely on a single fixed indicator to stop the traffic. If the C2 pointer is derived from a decentralized ledger, simple domain blocking may fail, and sinkholing becomes more difficult. In real attacks, analysts may see malware query a blockchain API, wallet address, or contract, then use the returned value to connect out. Defenders look for unusual blockchain access from endpoints, decode the resolver logic, and block the malware's follow-up network behavior rather than only the on-chain source.