Chollima Hunter

← EtherHiding Tracker

0x92f3f39c1cde5ee705820af022e2b85c4eaa43f6

0x92f3f39c1cde5ee705820af022e2b85c4eaa43f6 is a cryptocurrency wallet address that 2 published sources report in connection with EtherHiding activity, which no published source ties to North Korea (DPRK). It is cited here from Chollima Hunter (on-chain observation) and LevelBlue. The earliest of those reports is dated 2026-10-07 and the most recent 2026-10-12.

DPRK link unconfirmed LevelBlue SpiderLabs ties this to the PhantomPolia loader, which delivers Remus Stealer through ClickFix lures, and names no actor or state; no DPRK link is published for it. The EtherHiding tracker covers every reported EtherHiding contract and wallet, not only North Korean ones, so this value may belong to another actor.

C2 hosts this address pointed malware at, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. A host whose verdict is decoy was written between real values and is not C2. See the EtherHiding Tracker.

C2 hostTransactionVerdictNetworkProviderCountryRegisteredFirst writtenLast written
ironphantomcore.top Malicious 2026-06-05 reported
nightflamevortex.top Malicious 2026-06-05 reported
shadowemberstrike.top Malicious 2026-06-05 reported
stormvenomforge.top Malicious 2026-06-05 reported
velnoderic.com Malicious 2026-07-27 reported
voderlence.com Malicious 2026-07-27 reported
voidravenstorm.top Malicious 2026-06-05 reported

wallet address EtherHiding CURATED

First seen 2026-10-07 · last seen 2026-10-12

Sources

  • Ethereum Sepolia wallet that deployed all seven PhantomPolia resolver contracts LevelBlue SpiderLabs reported, and 22 more holding the same encrypted salt:iv:ciphertext configuration behind getText(), in batches on 2026-05-26 and 27, 2026-06-06, 2026-07-27 and 2026-09-10. Each configuration is fixed at deployment and never rewritten, so a new C2 means a new contract. This site decrypted the seven reported configurations with the published passwords and got the seven reported domains; the others need passwords that have not been published. On-chain observation by this site.
    Ethereum Sepolia address 0x92f3f39c1cde5ee705820af022e2b85c4eaa43f6 — Chollima Hunter (on-chain observation) · pulled 2026-10-12

  • As printed:

    0x4dBdca7277427eDEe4D5b4E3D012bCa73Aefadf1

    Notes:

    Ethereum Sepolia wallet that deployed all seven PhantomPolia resolver contracts LevelBlue SpiderLabs reported, and 22 more holding the same encrypted salt:iv:ciphertext configuration behind getText(), in batches on 2026-05-26 and 27, 2026-06-06, 2026-07-27 and 2026-09-10. Each configuration is fixed at deployment and never rewritten, so a new C2 means a new contract. This site decrypted the seven reported configurations with the published passwords and got the seven reported domains; the others need passwords that have not been published. On-chain observation by this site.
    Inside PhantomPolia: Remus Stealer Delivery via Donut Shellcode in ClickFix Campaign — LevelBlue · published 2026-10-07 · pulled 2026-10-12

Find this indicator in the index, or see every cryptocurrency wallet address this site holds under Cryptocurrency wallet addresses in the browse listing.

Related indicators

Cited by the same report: Inside PhantomPolia: Remus Stealer Delivery via Donut Shellcode in ClickFix Campaign

LevelBlue lists 40 other indicators in this source. 12 are shown, chosen across types.

All 41 indicators from this source

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.