Chollima Hunter

← EtherHiding Tracker

0x439fbf20c9ddd49ec7b2e8cb52804f48f6e913e4

0x439fbf20c9ddd49ec7b2e8cb52804f48f6e913e4 is a smart contract address that one published source reports in connection with EtherHiding activity, which no published source ties to North Korea (DPRK). It is cited here from Chollima Hunter (on-chain observation). The report is dated 2026-03-13.

DPRK link unconfirmed Found by this site's hunt in a chain-wide sweep for the DataUpdated(string,string) event; no published report covers it. The stored values are cryptocurrency-miner configurations, which points to a cryptojacking operation, and nothing ties it to North Korea. The EtherHiding tracker covers every reported EtherHiding contract and wallet, not only North Korean ones, so this value may belong to another actor.

C2 hosts this address pointed malware at, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. A host whose verdict is decoy was written between real values and is not C2. See the EtherHiding Tracker.

C2 hostTransactionVerdictNetworkProviderCountryRegisteredFirst writtenLast written
109.107.167.184 Malicious data centre Servers Tech Fzco AS216071 The Netherlands reported
144.124.224.120 Malicious data centre Servers Tech Fzco AS216071 The Netherlands reported
212.34.142.111 Malicious data centre Servers Tech Fzco AS216071 The Netherlands reported
78.40.198.61 Malicious data centre Servers Tech Fzco AS216071 The Netherlands reported
89.124.115.52 Malicious data centre Servers Tech Fzco AS216071 The Netherlands reported
89.124.117.170 Malicious data centre Servers Tech Fzco AS216071 The Netherlands reported
91.184.242.248 Malicious data centre Aeza International LTD AS210644 The Netherlands reported
92.118.168.26 Malicious fixed line OVH SAS AS16276 France reported

smart contract address EtherHiding CURATED

First seen 2026-03-13 · last seen 2026-03-13

Source

  • Polygon contract deployed by 0x19532c0fbaf0fb8c1d0f3fac0b704bf2f4645539 that stores an XOR-encoded cryptocurrency-miner configuration, written 88 time(s) between 2026-03-13 and 2026-10-29. The decoded configurations name 144.124.224.120, 89.124.115.52, 92.118.168.26, 89.124.117.170, 78.40.198.61, xmr-eu1.nanopool.org, 212.34.142.111, 109.107.167.184, 91.184.242.248 as the pool or configuration server. The writes of 2026-10-29 changed only the idle CPU share, from 70 to 80 per cent, and kept 78.40.198.61 as the pool.
    Polygon transaction 0x1b3ea7f62c71d668ff25e3d3f617163ee685fae93056f0be5831d9092821ce3a (first configuration write) — Chollima Hunter (on-chain observation) · published 2026-03-13 · pulled 2026-10-20

Find this indicator in the index, or see every smart contract address this site holds under Smart contract addresses in the browse listing.

Related indicators

Cited by the same report: Polygon transaction 0x1b3ea7f62c71d668ff25e3d3f617163ee685fae93056f0be5831d9092821ce3a (first configuration write)

Chollima Hunter (on-chain observation) lists 1 other indicator in this source.

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.