← EtherHiding Tracker

0x33ff3edaf55a8e03dcbc7cb40d498a49cd499891

0x33ff3edaf55a8e03dcbc7cb40d498a49cd499891 is a cryptocurrency wallet address that 2 published sources report in connection with EtherHiding / UNC5342, NullReceiver and Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Ransom-ISAC and Chollima Hunter (on-chain observation). The earliest of those reports is dated 2026-09-25 and the most recent 2026-10-31.

On-chain links

C2 hosts this address pointed malware at, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. A host whose verdict is decoy was written between real values and is not C2. See the EtherHiding Tracker.

wallet address EtherHiding / UNC5342NullReceiverContagious Interview CURATED

First seen 2026-09-25 · last seen 2026-10-31

Sources

• As printed:

  The signal wallet ( 0x33ff3edaf55a8e03dcbc7cb40d498a49cd499891 ) is an actively maintained channel, not dormant infrastructure. It sent 2,655 outbound transactions between 23 June 2026 and 21 September 2026, and it still beacons. The current …

  Notes:

  Ethereum wallet whose outbound transactions the September 2026 XCTDH implant scans for. A module the malware calls _Z samples recent blocks through public RPC endpoints, looks for transactions whose sender contains 33ff3edaf55a8e03dcbc7cb40d498a49, and decodes an IPv4 address and port from the first six bytes of the recipient address, the same recipient-address encoding OpenSourceMalware published as NullReceiver. Ransom-ISAC reports 2,655 outbound transactions from 23 June 2026 to 21 September 2026, one about every 50 minutes, with the encoded address rotated four times in that window, and calls the technique Hash Hiding. Ransom-ISAC labels the campaign DPRK-attributed and ties it to the same BSC wallet as its October 2025 series. This site's refresh has followed the rotations since: on 2026-10-06 and again on 2026-10-31 the wallet sent a single transaction to the second signal address 0x596dcc9fda875309ff85eba09cf5a97d8c7691bb, and from 2026-11-02 its recipient encodes 95.135.181.25, the host the second address's stages also name.

  XCTDH Adopts Hash Hiding — Ransom-ISAC · published 2026-09-25 · pulled 2026-10-03

• Ethereum wallet whose outbound transactions the September 2026 XCTDH implant scans for. A module the malware calls _Z samples recent blocks through public RPC endpoints, looks for transactions whose sender contains 33ff3edaf55a8e03dcbc7cb40d498a49, and decodes an IPv4 address and port from the first six bytes of the recipient address, the same recipient-address encoding OpenSourceMalware published as NullReceiver. Ransom-ISAC reports 2,655 outbound transactions from 23 June 2026 to 21 September 2026, one about every 50 minutes, with the encoded address rotated four times in that window, and calls the technique Hash Hiding. Ransom-ISAC labels the campaign DPRK-attributed and ties it to the same BSC wallet as its October 2025 series. This site's refresh has followed the rotations since: on 2026-10-06 and again on 2026-10-31 the wallet sent a single transaction to the second signal address 0x596dcc9fda875309ff85eba09cf5a97d8c7691bb, and from 2026-11-02 its recipient encodes 95.135.181.25, the host the second address's stages also name.

  Ethereum transaction 0xd26dbb6733f83336f8fb55589f2c59c55a6895842733fe954bc8e20b766aa4e8 — Chollima Hunter (on-chain observation) · published 2026-10-31 · pulled 2026-10-03

Find this indicator in the index, or see every cryptocurrency wallet address this site holds under Cryptocurrency wallet addresses in the browse listing.

Related indicators

Cited by the same report: XCTDH Adopts Hash Hiding

Ransom-ISAC lists 19 other indicators in this source. 12 are shown, chosen across types.

• 193.32.162.52 IP address
• 2.56.123.203 IP address
• 89.19.222.25 IP address
• 95.135.181.15 IP address
• 95.135.181.25 IP address
• 0x610c9ec972545b8df6e3aaecc7a8ab5f2f2445cf0bfbd6ee026e618d07b29e22 transaction hash
• 0x84e8cecd5b077eef530e7d69d546e2555199cb61759d1224d31cb31750788f62 transaction hash
• 0x3d2075f97b7b1e3234bd653779d21c605d7d8c6ec9c98d983880be5c7f4f9471 cryptocurrency wallet address
• 0x596dcc9fda875309ff85eba09cf5a97d8c7691bb cryptocurrency wallet address
• 0x9d202c824402ca89e9aaccd2390b6f8b332ae743caa1469c695feb2781d56519 cryptocurrency wallet address
• 0xb5d6959301bbb5d69593005000ffaba8a5a2ada2 cryptocurrency wallet address
• TCqf6ZkaQD84vYsC2cuu1jRwB6JveTaRrF cryptocurrency wallet address

All 20 indicators from this source