0xe2a54e1d101946e92b04a19fb14ca63a7a5a7af9841cee7f00e68995a2621a98
0xe2a54e1d101946e92b04a19fb14ca63a7a5a7af9841cee7f00e68995a2621a98 is a transaction hash
that 2 published sources report
in connection with EtherHiding / UNC5342 and Contagious Interview activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Chollima Hunter (on-chain observation) and Google Threat Intelligence Group.
The earliest of those reports is dated 2025-10-16 and the most recent 2026-09-03.
transaction hash EtherHiding / UNC5342Contagious Interview CURATED
Sources
-
Ethereum transaction sent at 14:39:35 UTC on 2025-02-07 from 0x9bc1355344b54dedf3e44296916ed15653844509, the owner address already in this watchlist, to the burn address 0x000000000000000000000000000000000000dEaD, carrying 16,236 bytes of calldata and no value. It is one of ten such transactions this site found by enumerating that wallet, of which GTIG lists three; this is one of the seven that appear in no reporting this site is aware of. Its calldata carries the same profile as the three that are reported -- comparable size, and 6.2 to 6.3 bits of entropy per byte, so encoded or encrypted rather than readable. The payload was not decoded and no malware family is asserted for it here: what is established is the sender, the destination, the timing inside the same five-hour window, and the shape.
Ethereum transaction 0xe2a54e1d101946e92b04a19fb14ca63a7a5a7af9841cee7f00e68995a2621a98 — Chollima Hunter (on-chain observation) -
Ethereum transaction sent at 14:39:35 UTC on 2025-02-07 from 0x9bc1355344b54dedf3e44296916ed15653844509, the owner address already in this watchlist, to the burn address 0x000000000000000000000000000000000000dEaD, carrying 16,236 bytes of calldata and no value. It is one of ten such transactions this site found by enumerating that wallet, of which GTIG lists three; this is one of the seven that appear in no reporting this site is aware of. Its calldata carries the same profile as the three that are reported -- comparable size, and 6.2 to 6.3 bits of entropy per byte, so encoded or encrypted rather than readable. The payload was not decoded and no malware family is asserted for it here: what is established is the sender, the destination, the timing inside the same five-hour window, and the shape.
DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains — Google Threat Intelligence Group
Find this indicator in the index, or see every transaction hash this site holds under Transaction hashes in the browse listing.