← EtherHiding Tracker

0x52221c293a21d8ca7afd01ac6bfac7175d590a84

0x52221c293a21d8ca7afd01ac6bfac7175d590a84 is a cryptocurrency wallet address that one published source reports in connection with EtherHiding activity, which no published source ties to North Korea (DPRK). It is cited here from Unit 42 (Palo Alto Networks). The report is dated 2026-07-21.

DPRK link unconfirmed Unit 42 lists this among npm and PyPI packages from "multiple distinct threat actors" and names none; the same contract and key are the Tsundere botnet's, which Kaspersky reported in November 2025 with no North Korean link. No published source ties it to North Korea. The EtherHiding tracker covers every reported EtherHiding contract and wallet, not only North Korean ones, so this value may belong to another actor.

On-chain links

C2 hosts this address pointed malware at, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. A host whose verdict is decoy was written between real values and is not C2. See the EtherHiding Tracker.

wallet address EtherHiding CURATED

First seen 2026-07-21 · last seen 2026-07-21

Source

• As printed:

  0x52221c293a21D8CA7AFD01Ac6bFAC7175D590A84

  Notes:

  Lookup key the npm droppers pass to the resolver contract 0xa1b40044ebc2794f207d45143bd82a1b86156c6b to read their download server.

  Further malicious infrastructure from npm and PyPI supply chain packages — Unit 42 (Palo Alto Networks) · published 2026-07-21 · pulled 2026-10-26

Find this indicator in the index, or see every cryptocurrency wallet address this site holds under Cryptocurrency wallet addresses in the browse listing.

Related indicators

Cited by the same report: Further malicious infrastructure from npm and PyPI supply chain packages

Unit 42 (Palo Alto Networks) lists 1 other indicator in this source.

• 0xa1b40044ebc2794f207d45143bd82a1b86156c6b smart contract address