0x3926dd74bf8b41c19982bead1fc200426789a75d
0x3926dd74bf8b41c19982bead1fc200426789a75d is a smart contract address
that 2 published sources report
in connection with EtherHiding activity, which no
published source ties to North Korea (DPRK).
It is cited here from Chollima Hunter (on-chain observation) and Alex Necula (LinkedIn).
The earliest of those reports is dated 2026-10-07 and the most recent 2026-10-12.
DPRK link unconfirmed Alex Necula ties this contract to a ClickFix infection chain delivering infostealers, including Atomic macOS Stealer, and names no actor or state; no DPRK link is published for it. The EtherHiding tracker covers every reported EtherHiding contract and wallet, not only North Korean ones, so this value may belong to another actor.
smart contract address EtherHiding CURATED
Sources
-
Polygon contract deployed by 0xede997d36941cf3b6f6f11e72a0393c7f19b3822, the operator of the ClickFix configuration contract 0xf55bea1fdcf1c3abb39ab92567c09ac1bff6753e, which has written nothing to it. The value was not decrypted. Found by this site's EtherHiding hunt on 2026-10-12.
Polygon address 0x3926dd74bf8b41c19982bead1fc200426789a75d — Chollima Hunter (on-chain observation) -
Queries a smart contract on Polygon (e.g., 0xf55Bea...753E) using the eth_call JSON-RPC method.
Polygon contract deployed by 0xede997d36941cf3b6f6f11e72a0393c7f19b3822, the operator of the ClickFix configuration contract 0xf55bea1fdcf1c3abb39ab92567c09ac1bff6753e, which has written nothing to it. The value was not decrypted. Found by this site's EtherHiding hunt on 2026-10-12.
Hunting EtherHiding: How I Uncovered 230+ C2 Domains Hidden on the Polygon Blockchain — Alex Necula (LinkedIn)
Find this indicator in the index, or see every smart contract address this site holds under Smart contract addresses in the browse listing.