`0xf55bea1fdcf1c3abb39ab92567c09ac1bff6753e`

0xf55bea1fdcf1c3abb39ab92567c09ac1bff6753e is a smart contract address that 2 published sources report in connection with EtherHiding activity, which no published source ties to North Korea (DPRK). It is cited here from Alex Necula (LinkedIn) and Chollima Hunter (on-chain observation). The earliest of those reports is dated 2026-09-19 and the most recent 2026-10-07.

DPRK link unconfirmed Alex Necula ties this contract to a ClickFix infection chain delivering infostealers, including Atomic macOS Stealer, and names no actor or state; no DPRK link is published for it. The EtherHiding tracker covers every reported EtherHiding contract and wallet, not only North Korean ones, so this value may belong to another actor.

Write transactions

Every transaction that wrote a value to this contract, newest first, as read from Polygonscan on 2026-10-20. Values are shown as the operator wrote them; an encrypted one has not been decrypted.

Date	Transaction	Sender	Value written
2026-09-19	`0xe85571c6d135…`	`0xede997d36941…`	`71bacfba19a96205513e1fdc305e126dda7f636865c201746164c47e99e0d1699b76184a383c71935ef928d3ba48ea3bd6fdc265698cdf13cfb30149a9735f99`
2026-09-03	`0x15617ecfbba5…`	`0xede997d36941…`	`23741d71a3c23cb8951102f086220e22c12ae6e630dafd6766b8402fd16f60055f46b9c1cf6f48540258dcaf1ff5ed02a0f0a287b054248182e30a75a8a94149`
2026-08-25	`0x092d9683058a…`	`0xede997d36941…`	`f8543383601c689d3a3306306145bcc14efe646124e548bd86b76f6655c7fbbd3e674c617a12e902019ec9f7a7d0f93d8604f21660a79177754a57824511d7cd`
2026-08-22	`0x011c32b7233c…`	`0xede997d36941…`	`30289f0233842fe6c5e1371dab694aa7f2627d248fa48a4c13cd03a1e53bcf5076a55c017f1a912f7d1b72f6674dcc9e4fe46031e90ae1f77e01bf6514dfbd2e`
2026-07-01	`0xabc415bff4f7…`	`0xede997d36941…`	`1eb4370b622a6ba7138d7c92ca64b6025a208a0891489b1f4f32702bc34bf63330a33f5fd8cf3115350f4306ed296370489259f298e6e0a6efd1525bde059e72`
2026-04-27	`0xe12678330930…`	`0xede997d36941…`	`2617a1d301fae2e1bc0fe3c40735d5284377cfc953cd18e7e192a0fffec94d015d09ee2781806b4c93510cda60832120aa0805ba7b1385d36961230d72517e17`

smart contract address EtherHiding CURATED

First seen 2026-09-19 · last seen 2026-10-07

Sources

As printed:

Queries a smart contract on Polygon (e.g., 0xf55Bea...753E) using the eth_call JSON-RPC method.

Notes:

Polygon configuration contract that Alex Necula gives as an example of the ClickFix campaign's EtherHiding dead drop: the malware reads it with eth_call and decrypts the C2 it returns. Deployed on 2026-04-27 by 0xede997d36941cf3b6f6f11e72a0393c7f19b3822, which rewrote it six times with setConfig(string) through 2026-09-19; each value is a base64 string, encrypted, and was not decoded here. The full address and operator were recovered by this site from the shortened address and the transaction list in the article's screenshot.
Hunting EtherHiding: How I Uncovered 230+ C2 Domains Hidden on the Polygon Blockchain — Alex Necula (LinkedIn) · published 2026-10-07 · pulled 2026-10-12
Polygon configuration contract that Alex Necula gives as an example of the ClickFix campaign's EtherHiding dead drop: the malware reads it with eth_call and decrypts the C2 it returns. Deployed on 2026-04-27 by 0xede997d36941cf3b6f6f11e72a0393c7f19b3822, which rewrote it six times with setConfig(string) through 2026-09-19; each value is a base64 string, encrypted, and was not decoded here. The full address and operator were recovered by this site from the shortened address and the transaction list in the article's screenshot.
Polygon transaction 0xe85571c6d1353192347f32483d6a9f971db5376bfad4fc027bf548e60ba0450d (setConfig, 2026-09-19) — Chollima Hunter (on-chain observation) · published 2026-09-19 · pulled 2026-10-12

Find this indicator in the index, or see every smart contract address this site holds under Smart contract addresses in the browse listing.

Related indicators

Cited by the same report: Hunting EtherHiding: How I Uncovered 230+ C2 Domains Hidden on the Polygon Blockchain

Alex Necula (LinkedIn) lists 5 other indicators in this source.