3fa56cbb32712d3a0aff2daf79737616832b860b18b77755755ad79b35e94436
3fa56cbb32712d3a0aff2daf79737616832b860b18b77755755ad79b35e94436 is a transaction hash
that one published source reports
in connection with EtherHiding / UNC5342 and Contagious Interview activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Ransom-ISAC.
The report is dated 2025-12-08.
transaction hash EtherHiding / UNC5342Contagious Interview CURATED
Source
-
Interestingly, the original TRX transaction by TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP ( 3fa56cbb32712d3a0aff2daf79737616832b860b18b77755755ad79b35e94436 ) with the message 'Mxy Custom Memo Text' points to a likely self custodial address, THK2LfzQ7FFgheR33fQcmBnPVnGKQNuetU . The counterparties of this address include known hubs for DPRK related funds , including Huione, Xinbi Guarantee and BlackU.
TRON transaction from the pointer address TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP carrying the memo "Mxy Custom Memo Text". Crystal Intelligence and Ransom-ISAC use it to show that the address sent to a likely self-custodial address whose counterparties include laundering hubs. That receiving address is not recorded here because the post does not say the operators control it. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.
Cross-Chain TxDataHiding Crypto Heist: A Very (Very) Chainful Process (Part 4) — Ransom-ISAC
Find this indicator in the index, or see every transaction hash this site holds under Transaction hashes in the browse listing.