`0x9bc1355344b54dedf3e44296916ed15653844509`

0x9bc1355344b54dedf3e44296916ed15653844509 is a smart contract address that 5 published sources report in connection with EtherHiding / UNC5342, Contagious Interview, PolinRider and NullReceiver activity, which public reporting attributes to North Korea (DPRK). It is cited here from Google Threat Intelligence Group, SafeDep, Socket and Ransom-ISAC. The earliest of those reports is dated 2025-10-16 and the most recent 2026-07-29.

On-chain links

C2 hosts this address pointed malware at, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. A host whose verdict is decoy was written between real values and is not C2. See the EtherHiding Tracker.

C2 host	Transaction	Verdict	Network	Provider	Country	Registered	First written	Last written
`23.27.20.143`	BscScan	Malicious	data centre	Ace Data Centers II AS149440	United Kingdom		2025-03-12	2025-03-12
`154.91.0.103`	BscScan	Malicious	fixed line	Evoxt Enterprise AS149440	United Kingdom		2025-02-19	2025-02-19

smart contract address EtherHiding / UNC5342Contagious Interview PolinRiderNullReceiver CURATED

Listed as Ethereum

First seen 2025-10-16 · last seen 2026-07-29

Sources

As printed:

owner: "0x9bc1355344b54dedf3e44296916ed15653844509",

Notes:

Owner/deployer address of the malicious BNB Smart Chain contract (see etherhiding-jadesnow-bsc-contract-8eac3198) publicly reported by GTIG/Mandiant as associated with DPRK actor UNC5342's EtherHiding infrastructure. Listed as the on-chain administrative address, not itself a contract hosting payload data.
DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains — Google Threat Intelligence Group · published 2025-10-16 · pulled 2026-08-13
…dead drop resolves to BSC transaction 0x18a8420f727f2405f9d1805ad887b31029b584b2ff5a7ec0f57c72635183e99d , sent from attacker wallet 0x9bc1355344b54dedf3e44296916ed15653844509 to the burn address 0x...dead .…
Joyfill npm Packages Compromised with Blockchain C2 Loader - Real-time Open Source Software Supply Chain Security — SafeDep · under “The blockchain dead drop (still live)” · published 2026-07-29 · pulled 2026-09-11
…0xb6c725890be6890fd2c735eedc47e24b85a350301f6c19a3864e43c35e470968 0x9bc1355344b54dedf3e44296916ed15653844509 Socket Firewall Blocks risky dependencies before they reach your environment Get Started Free Keep…
Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan | Socket — Socket · under “Blockchain identifiers and loader fingerprints #” · published 2026-07-28 · pulled 2026-09-11
…tokenInfo: { address: "0x8eac3198dd72f3e07108c4c7cff43108ad48a71c", (...) owner: "0x9bc1355344b54dedf3e44296916ed15653844509", (...) txsCount: 22, (...) }, type: "issuance", value: "1", priority: 127, address:…
DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains | Google Cloud Blog — Google Threat Intelligence Group · under “JADESNOW On-Chain Analysis” · published 2025-10-16 · pulled 2026-09-12
…BSC Transaction Hash (Payload1 Hash 2) 0xd33f78662df123adf2a178628980b605a0026c0d8c4f4e87e43e724cda258fef BSC Address (Payload 1 and 2) 0x9BC1355344B54DEDf3E44296916eD15653844509 Yara Rules These detection rules operate exclusively at the filesystem level to identify weaponised repositories within your…
Cross-Chain TxDataHiding Crypto Heist: A Very Chainful Process (Part 3) — Ransom-ISAC · under “Indicators of Compromise” · published 2025-10-20 · pulled 2026-10-01
…in Parts 1 and 2, timeline analysis was also performed on all transactions containing more than 10,000 characters associated with wallet 0x9BC1355344B54DEDf3E44296916eD15653844509 .…
Cross-Chain TxDataHiding Crypto Heist: A Very (Very) Chainful Process (Part 4) — Ransom-ISAC · under “RAT Timeline” · published 2025-12-08 · pulled 2026-10-03

Find this indicator in the index, or see every smart contract address this site holds under Smart contract addresses in the browse listing.

Related indicators

Cited by the same report: DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains

Google Threat Intelligence Group lists 16 other indicators in this source. 5 are shown, chosen across types.

All 17 indicators from this source

Cited by the same report: Joyfill npm Packages Compromised with Blockchain C2 Loader - Real-time Open Source Software Supply Chain Security

SafeDep lists 4 other indicators in this source.

Cited by the same report: Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan | Socket

Socket lists 4 other indicators in this source. 2 are shown, chosen across types.

All 5 indicators from this source