`0xcdaf449700573d1ecdfb64d622fca84b179b1aa1`

0xcdaf449700573d1ecdfb64d622fca84b179b1aa1 is a smart contract address that 2 published sources report in connection with EtherHiding activity, which no published source ties to North Korea (DPRK). It is cited here from Chollima Hunter (on-chain observation) and LevelBlue. The earliest of those reports is dated 2026-05-27 and the most recent 2026-10-07.

DPRK link unconfirmed LevelBlue SpiderLabs ties this to the PhantomPolia loader, which delivers Remus Stealer through ClickFix lures, and names no actor or state; no DPRK link is published for it. The EtherHiding tracker covers every reported EtherHiding contract and wallet, not only North Korean ones, so this value may belong to another actor.

Write transactions

Every transaction that wrote a value to this contract, newest first, as read from Sepolia Etherscan on 2026-10-20. Values are shown as the operator wrote them; an encrypted one has not been decrypted.

Date	Transaction	Sender	Value written
2026-05-28	`0x94b48e274908…`	`0x92f3f39c1cde…`	`c33780e493ddeec85e7f98d97a6ae7f0:f8dcafb859aedab5f355965a19102060:cfa470c0e74eb1990bf0275b61f5f7479bc8a302023693770f01528208e06669`
2026-05-28	`0xb6c8c8027894…`	`0x92f3f39c1cde…`	`90f7b89c0738d700bf160e7542ec28ac:05a763c124e52e4a0970828d22aad23e:ee8828a297904a7e51ca9bb0d1465eb17ae4c1bd1d96182ad7b7ef92`
2026-05-27	`0x6cc9e241ecdb…`	`0x92f3f39c1cde…`	`1f43da4faeff2031d193184be83a4551:1ef484944b6a1e99412c13c21ec841b5:04acca8f529854cea78c551b15ca024066afb45f172dfe8919eb6473e7c10b5a`

smart contract address EtherHiding CURATED

First seen 2026-05-27 · last seen 2026-10-07

Sources

Ethereum Sepolia contract deployed on 2026-05-27 by 0x92f3f39c1cde5ee705820af022e2b85c4eaa43f6, the wallet behind the PhantomPolia resolver contracts LevelBlue SpiderLabs reported. Like them it returns an encrypted salt:iv:ciphertext configuration from getText() (selector 0xe00fe2eb), fixed at deployment. None of the seven published passwords opens it, so the C2 domain it resolves to is not known. Found by this site on 2026-10-12; that it serves PhantomPolia rests on the shared deployer and format, not on a report.
Ethereum Sepolia transaction 0x44402c8180c05e321de5c802b46d1e1ab03f7d24d53b1ee43b719357123dd168 (deployment) — Chollima Hunter (on-chain observation) · published 2026-05-27 · pulled 2026-10-12
As printed:

0x4dBdca7277427eDEe4D5b4E3D012bCa73Aefadf1

Notes:

Ethereum Sepolia contract deployed on 2026-05-27 by 0x92f3f39c1cde5ee705820af022e2b85c4eaa43f6, the wallet behind the PhantomPolia resolver contracts LevelBlue SpiderLabs reported. Like them it returns an encrypted salt:iv:ciphertext configuration from getText() (selector 0xe00fe2eb), fixed at deployment. None of the seven published passwords opens it, so the C2 domain it resolves to is not known. Found by this site on 2026-10-12; that it serves PhantomPolia rests on the shared deployer and format, not on a report.
Inside PhantomPolia: Remus Stealer Delivery via Donut Shellcode in ClickFix Campaign — LevelBlue · published 2026-10-07 · pulled 2026-10-12

Find this indicator in the index, or see every smart contract address this site holds under Smart contract addresses in the browse listing.

Related indicators

Cited by the same report: Inside PhantomPolia: Remus Stealer Delivery via Donut Shellcode in ClickFix Campaign

LevelBlue lists 40 other indicators in this source. 12 are shown, chosen across types.

All 41 indicators from this source