← EtherHiding Tracker

0x88361c914bb0942da9a1b7bb396a7513c1917aee

0x88361c914bb0942da9a1b7bb396a7513c1917aee is a cryptocurrency wallet address that 2 published sources report in connection with EtherHiding activity, which no published source ties to North Korea (DPRK). It is cited here from Chollima Hunter (on-chain observation) and Confiant. The earliest of those reports is dated 2026-08-28 and the most recent 2026-11-11.

DPRK link unconfirmed Confiant tracks this cluster as HexMage, a Magecart card-skimming operation that loads its skimmer through EtherHiding, and names no actor or state; it mentions DPRK-linked EtherHiding only as separate work, and no DPRK link is published for it. The EtherHiding tracker covers every reported EtherHiding contract and wallet, not only North Korean ones, so this value may belong to another actor.

On-chain links

C2 hosts this address pointed malware at, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. A host whose verdict is decoy was written between real values and is not C2. See the EtherHiding Tracker.

wallet address EtherHiding CURATED

First seen 2026-08-28 · last seen 2026-11-11

Sources

• Ethereum Sepolia wallet that owns every HexMage resolver contract Confiant reported: owner-gated TextStorage contracts exposing getText() (selector 0xe00fe2eb) and setText(string), with byte-identical 1,415-byte runtime code (sha256 84a8e7a07890558fe82d53d4d0c8f65341fa4275b627b4466f61997ee2bbbbc5). A checkout page compromised by the cluster loads ethers.js, reads one contract's value over public Sepolia RPC, and turns it into the host that serves a card skimmer. Confiant counted 144 contracts deployed between 2026-03-28 and 2026-07-21; when this site read the wallet on 2026-11-11 it had created 183 contracts, the latest on 2026-11-05. Of those, 49 hold a host in plain base64, 122 hold a salt:iv:ciphertext value sealed with a per-loader password, and 12 hold test strings. The 41 plaintext hosts are the ones Confiant lists; the seven published PhantomPolia passwords, which use the same PBKDF2 and AES-GCM scheme, open none of the sealed values.

  Ethereum Sepolia address 0x88361c914bb0942da9a1b7bb396a7513c1917aee — Chollima Hunter (on-chain observation) · pulled 2026-11-11

• As printed:

  0x88361C914Bb0942da9a1b7Bb396a7513C1917aee

  Notes:

  Ethereum Sepolia wallet that owns every HexMage resolver contract Confiant reported: owner-gated TextStorage contracts exposing getText() (selector 0xe00fe2eb) and setText(string), with byte-identical 1,415-byte runtime code (sha256 84a8e7a07890558fe82d53d4d0c8f65341fa4275b627b4466f61997ee2bbbbc5). A checkout page compromised by the cluster loads ethers.js, reads one contract's value over public Sepolia RPC, and turns it into the host that serves a card skimmer. Confiant counted 144 contracts deployed between 2026-03-28 and 2026-07-21; when this site read the wallet on 2026-11-11 it had created 183 contracts, the latest on 2026-11-05. Of those, 49 hold a host in plain base64, 122 hold a salt:iv:ciphertext value sealed with a per-loader password, and 12 hold test strings. The 41 plaintext hosts are the ones Confiant lists; the seven published PhantomPolia passwords, which use the same PBKDF2 and AES-GCM scheme, open none of the sealed values.

  Skimming on the Blockchain: A Magecart Campaign That Uses EtherHiding, Found by Malvertising Scanning — Confiant · published 2026-08-28 · pulled 2026-11-11

Find this indicator in the index, or see every cryptocurrency wallet address this site holds under Cryptocurrency wallet addresses in the browse listing.

Related indicators

Cited by the same report: Skimming on the Blockchain: A Magecart Campaign That Uses EtherHiding, Found by Malvertising Scanning

Confiant lists 75 other indicators in this source. 12 are shown, chosen across types.

• ashenravenfort.top domain
• styledespair.com domain
• styledupstep.com domain
• styleember.com domain
• styleferry.com domain
• stylegamagee.com domain
• stylegamingg.com domain
• 0xe0f9aca9384da7b7dd04fa9fe06dfe51d816d9ec smart contract address
• 0xf56f2af13080ea86c718849139fbf404b5050558 smart contract address
• 0xf8290bea4e7585302ba9984b76766d4f0e282c0e smart contract address
• 0xff2ff2de4bf5434a160b666a1a17559fb454eee2 smart contract address
• 0xffbc6712ef6b8f4c8542cbc51fc6bbca06b08455 smart contract address

All 76 indicators from this source