`0xe4aa6fc8f6d92f8c26158cfadeae55bae80c816f`

0xe4aa6fc8f6d92f8c26158cfadeae55bae80c816f is a smart contract address that one published source reports in connection with EtherHiding activity, which no published source ties to North Korea (DPRK). It is cited here from Chollima Hunter (on-chain observation). The report is dated 2026-04-15.

DPRK link unconfirmed Found by this site's hunt in a chain-wide sweep for the DataUpdated(string,string) event; no published report covers it. The stored values are cryptocurrency-miner configurations, which points to a cryptojacking operation, and nothing ties it to North Korea. The EtherHiding tracker covers every reported EtherHiding contract and wallet, not only North Korean ones, so this value may belong to another actor.

On-chain links

C2 hosts this address pointed malware at, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. A host whose verdict is decoy was written between real values and is not C2. See the EtherHiding Tracker.

C2 host	Transaction	Verdict	Network	Provider	Country	Registered	First written	Last written
`109.107.167.184`		Malicious	data centre	Servers Tech Fzco AS216071	The Netherlands		reported

smart contract address EtherHiding CURATED

First seen 2026-04-15 · last seen 2026-04-15

Source

Polygon contract deployed by 0x19532c0fbaf0fb8c1d0f3fac0b704bf2f4645539 that stores an XOR-encoded cryptocurrency-miner configuration, written 1 time(s) between 2026-04-15 and 2026-04-15. The decoded configurations name 109.107.167.184 as the pool or configuration server.
Polygon transaction 0xeb324ee806b62a9b215ee5f859a664e1bca8ef671a2c530363d98ff9f12d65dd (first configuration write) — Chollima Hunter (on-chain observation) · published 2026-04-15 · pulled 2026-10-20

Find this indicator in the index, or see every smart contract address this site holds under Smart contract addresses in the browse listing.