Chollima Hunter

← EtherHiding Tracker

0xffbc6712ef6b8f4c8542cbc51fc6bbca06b08455

0xffbc6712ef6b8f4c8542cbc51fc6bbca06b08455 is a smart contract address that 2 published sources report in connection with EtherHiding activity, which no published source ties to North Korea (DPRK). It is cited here from Confiant and Chollima Hunter (on-chain observation). The earliest of those reports is dated 2026-08-28 and the most recent 2026-11-11.

DPRK link unconfirmed Confiant tracks this cluster as HexMage, a Magecart card-skimming operation that loads its skimmer through EtherHiding, and names no actor or state; it mentions DPRK-linked EtherHiding only as separate work, and no DPRK link is published for it. The EtherHiding tracker covers every reported EtherHiding contract and wallet, not only North Korean ones, so this value may belong to another actor.

C2 hosts this address pointed malware at, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. A host whose verdict is decoy was written between real values and is not C2. See the EtherHiding Tracker.

C2 hostTransactionVerdictNetworkProviderCountryRegisteredFirst writtenLast written
bloodboundcitadel.top Malicious 2026-06-17 reported

smart contract address EtherHiding CURATED

First seen 2026-08-28 · last seen 2026-11-11

Sources

  • As printed:

    0xffbc6712ef6b8f4c8542cbc51fc6bbca06b08455

    Notes:

    Ethereum Sepolia contract the HexMage Magecart loader reads as a dead-drop resolver through getText(). Confiant reports that it resolves to the skimmer delivery host bloodboundcitadel.top. Created on 2026-06-19 by 0x88361c914bb0942da9a1b7bb396a7513c1917aee; it holds a sealed salt:iv:ciphertext value that the loader decrypts with a per-build password (PBKDF2-SHA256, 100,000 iterations, AES-256-GCM).
    Skimming on the Blockchain: A Magecart Campaign That Uses EtherHiding, Found by Malvertising Scanning — Confiant · published 2026-08-28 · pulled 2026-11-11
  • Ethereum Sepolia contract the HexMage Magecart loader reads as a dead-drop resolver through getText(). Confiant reports that it resolves to the skimmer delivery host bloodboundcitadel.top. Created on 2026-06-19 by 0x88361c914bb0942da9a1b7bb396a7513c1917aee; it holds a sealed salt:iv:ciphertext value that the loader decrypts with a per-build password (PBKDF2-SHA256, 100,000 iterations, AES-256-GCM).
    Ethereum Sepolia address 0xffbc6712ef6b8f4c8542cbc51fc6bbca06b08455 — Chollima Hunter (on-chain observation) · pulled 2026-11-11

Find this indicator in the index, or see every smart contract address this site holds under Smart contract addresses in the browse listing.

Related indicators

Cited by the same report: Skimming on the Blockchain: A Magecart Campaign That Uses EtherHiding, Found by Malvertising Scanning

Confiant lists 75 other indicators in this source. 12 are shown, chosen across types.

All 76 indicators from this source

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.