`TLmj13VL4p6NQ7jpxz8d9uYY6FUKCYatSe`

TLmj13VL4p6NQ7jpxz8d9uYY6FUKCYatSe is a cryptocurrency wallet address that 2 published sources report in connection with EtherHiding / UNC5342 and Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Ransom-ISAC. The earliest of those reports is dated 2025-10-27 and the most recent 2025-12-08.

On-chain links

C2 hosts this address pointed malware at, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. A host whose verdict is decoy was written between real values and is not C2. See the EtherHiding Tracker.

C2 host	Verdict	Network	Provider	Country	First written
`136.0.9.8`	Malicious	data centre	Ace Data Centers II AS149440	United Kingdom	reported
`166.88.4.2`	Malicious	data centre	Ace Data Centers II AS149440	United Kingdom	reported
`23.27.20.143`	Malicious	data centre	Ace Data Centers II AS149440	United Kingdom	reported
`23.27.202.27`	Malicious	data centre	Ace Data Centers II AS149440	United States	reported

wallet address EtherHiding / UNC5342Contagious Interview CURATED

First seen 2025-10-27 · last seen 2025-12-08

Sources

As printed:

TRON: TLmj13VL4p6NQ7jpxz8d9uYY6FUKCYatSe → extracts transaction data, reverses it

Notes:

TRON address the malware queries for its most recent outbound transaction. Payload1_1 index in part 2, and the pointer address Ransom-ISAC's part 4 found carrying the most pointers to BSC transactions. The transaction's raw_data.data field holds a hex-encoded, reversed BSC transaction hash, which the malware then fetches from a BSC RPC node and decrypts as its next stage; an Aptos account is queried as a fallback. The address does not hold the payload and rotating the pointer is a single transaction. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.
Cross-Chain TxDataHiding Crypto Heist: A Very Chainful Process (Part 2) — Ransom-ISAC · published 2025-10-27 · pulled 2026-10-03
As printed:

Both addresses were funded by a common source for fees, TQdwohPCWqqfCUaCispyV1NaUZ1HgiJPUy . Examination of this fee paying address identified a third address, TLmj13VL4p6NQ7jpxz8d9uYY6FUKCYatSe that also contained a significant number of pointers to transactions on BSC. A review of all these transactions identified 52 pointers on other chains (See IoCs)

Notes:

TRON address the malware queries for its most recent outbound transaction. Payload1_1 index in part 2, and the pointer address Ransom-ISAC's part 4 found carrying the most pointers to BSC transactions. The transaction's raw_data.data field holds a hex-encoded, reversed BSC transaction hash, which the malware then fetches from a BSC RPC node and decrypts as its next stage; an Aptos account is queried as a fallback. The address does not hold the payload and rotating the pointer is a single transaction. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.
Cross-Chain TxDataHiding Crypto Heist: A Very (Very) Chainful Process (Part 4) — Ransom-ISAC · published 2025-12-08 · pulled 2026-10-03

Find this indicator in the index, or see every cryptocurrency wallet address this site holds under Cryptocurrency wallet addresses in the browse listing.

Related indicators

Cited by the same report: Cross-Chain TxDataHiding Crypto Heist: A Very Chainful Process (Part 2)

Ransom-ISAC lists 18 other indicators in this source. 7 are shown, chosen across types.

All 19 indicators from this source

Cited by the same report: Cross-Chain TxDataHiding Crypto Heist: A Very (Very) Chainful Process (Part 4)

Ransom-ISAC lists 56 other indicators in this source. 5 are shown, chosen across types.

All 57 indicators from this source