`0xa658863ea658863e68656c6c6f6970626f742121`

0xa658863ea658863e68656c6c6f6970626f742121 is a cryptocurrency wallet address that one published source reports in connection with EtherHiding / UNC5342, NullReceiver and Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from OpenSourceMalware. The report is dated 2026-08-02.

On-chain links

C2 hosts this address pointed malware at, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. A host whose verdict is decoy was written between real values and is not C2. See the EtherHiding Tracker.

C2 host	Transaction	Verdict	Network	Provider	Country	Registered	First written	Last written
`166.88.134.62`	Etherscan	Malicious	data centre	Ace Data Centers II AS149440	United Kingdom		2026-07-25	2026-08-22

wallet address EtherHiding / UNC5342NullReceiverContagious Interview CURATED

Listed as Ethereum

First seen 2026-08-02 · last seen 2026-08-02

Sources

As printed:

0xa658863ea658863e68656c6c6f6970626f742121

Notes:

Destination address of the NullReceiver lookup transaction, which is not a wallet anyone holds keys to but a value chosen so its bytes carry the C2 address. Decoding it byte by byte reproduces exactly what the reporting describes: bytes 0-3 and bytes 4-7 both read as 166.88.134.62, and the trailing twelve bytes are the ASCII string "helloipbot!!". A zero-value, zero-data transfer to an address like this is the cheapest and least remarkable transaction shape on the network, which is the property the technique is built around.
NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding — OpenSourceMalware · published 2026-08-02 · pulled 2026-08-30
…Attacker Ethereum Wallet 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a NullReceiver-Encoded Recipient Address 0xa658863ea658863e68656c6c6f6970626f742121 C2 Infrastructure 166.88.134.62:443 166.88.134.62:80
NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding | OpenSourceMalware — OpenSourceMalware · under “NullReceiver-Encoded Recipient Address” · published 2026-08-02 · pulled 2026-09-11

Find this indicator in the index, or see every cryptocurrency wallet address this site holds under Cryptocurrency wallet addresses in the browse listing.

Related indicators

Cited by the same report: NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding

OpenSourceMalware lists 15 other indicators in this source. 12 are shown, chosen across types.

All 16 indicators from this source