Chollima Hunter

← EtherHiding Tracker

TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP

TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP is a cryptocurrency wallet address that 15 published sources report in connection with PolinRider, Contagious Interview, EtherHiding / UNC5342 and NullReceiver activity, which public reporting attributes to North Korea (DPRK). It is cited here from OpenSourceMalware, Ransom-ISAC, Panther Labs, Socket, SafeDep and Open Source Malware. The earliest of those reports is dated 2025-10-20 and the most recent 2026-11-13.

C2 hosts this address pointed malware at, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. A host whose verdict is decoy was written between real values and is not C2. See the EtherHiding Tracker.

C2 hostTransactionVerdictNetworkProviderCountryRegisteredFirst writtenLast written
136.0.9.8 BscScan Malicious data centre Ace Data Centers II AS149440 United Kingdom 2026-03-04 2026-03-26
198.105.127.210 BscScan Malicious data centre Evoxt Sdn. Bhd. AS149440 United Kingdom 2026-03-04 2026-03-26
23.27.202.27 BscScan Malicious data centre Ace Data Centers II AS149440 United States 2026-03-04 2026-03-26
166.88.4.2 Malicious data centre Ace Data Centers II AS149440 United Kingdom reported
23.27.20.143 Malicious data centre Ace Data Centers II AS149440 United Kingdom reported
auth-rho-dun.vercel.app Malicious reported
data-kappa.vercel.app Malicious reported

wallet address PolinRiderContagious InterviewEtherHiding / UNC5342NullReceiver CURATED

Listed as Tron

First seen 2025-10-20 · last seen 2026-11-13

Sources

  • Primary TRON dead-drop wallet address used as blockchain-based command-and-control infrastructure in the PolinRider campaign: the malware reads transaction data sent to this address, XOR-decrypts it with a hardcoded key, and executes the result as its next-stage payload. Reported by OpenSourceMalware.
    PolinRider — OpenSourceMalware · published 2026-07-10 · pulled 2026-08-30

  • As printed:

    https://api.trongrid.io/v1/accounts/TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP/transactions?only_confirmed=true&only_from=true&limit=1

    Notes:

    TRON address the malware queries for its most recent outbound transaction. Payload1 index 1 in part 2. The transaction's raw_data.data field holds a hex-encoded, reversed BSC transaction hash, which the malware then fetches from a BSC RPC node and decrypts as its next stage; an Aptos account is queried as a fallback. The address does not hold the payload and rotating the pointer is a single transaction. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.
    Cross-Chain TxDataHiding Crypto Heist: A Very Chainful Process (Part 2) — Ransom-ISAC · published 2025-10-27 · pulled 2026-10-03

  • As printed:

    From the previous investigation, we began with the following TRON network start points, TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP and TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG .

    Notes:

    TRON address the malware queries for its most recent outbound transaction. Payload1 index 1 in part 2. The transaction's raw_data.data field holds a hex-encoded, reversed BSC transaction hash, which the malware then fetches from a BSC RPC node and decrypts as its next stage; an Aptos account is queried as a fallback. The address does not hold the payload and rotating the pointer is a single transaction. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.
    Cross-Chain TxDataHiding Crypto Heist: A Very (Very) Chainful Process (Part 4) — Ransom-ISAC · published 2025-12-08 · pulled 2026-10-03

  • As printed:

    The malware queries a TRON wallet (e.g. TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP ) for its latest transaction, with Aptos as a fallback

    Notes:

    TRON address the malware queries for its most recent outbound transaction. Payload1 index 1 in part 2. The transaction's raw_data.data field holds a hex-encoded, reversed BSC transaction hash, which the malware then fetches from a BSC RPC node and decrypts as its next stage; an Aptos account is queried as a fallback. The address does not hold the payload and rotating the pointer is a single transaction. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.
    XCTDH Adopts Hash Hiding — Ransom-ISAC · published 2026-09-25 · pulled 2026-10-03

  • As printed:

    Tron: TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP , TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG

    Notes:

    TRON address the malware queries for its most recent outbound transaction. Payload1 index 1 in part 2. The transaction's raw_data.data field holds a hex-encoded, reversed BSC transaction hash, which the malware then fetches from a BSC RPC node and decrypts as its next stage; an Aptos account is queried as a fallback. The address does not hold the payload and rotating the pointer is a single transaction. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.
    Neutralinojs Compromised In DPRK Attack — OpenSourceMalware · published 2026-03-06 · pulled 2026-10-03
  • …0xbe037400670fbf1c32364f762975908dc43eeb38759263e7dfcdabc76380811e Aptos TA48dct6rFW8BXsiLAtjFaVFoSuryMjD3v TRON (TRC20) TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP TRON (TRC20) TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG TRON (TRC20) Blockchain transaction hashes (3) The transaction hashes…
    Inside DPRK’s npm Malware Factory: 108 Packages & 261 Versions — Panther Labs · under “Wallet and blockchain addresses (5)” · published 2026-04-24 · pulled 2026-09-02
  • …(txHash); return xorDecrypt (encryptedPayload, xorKey); } const firstStage = await resolvePayload ( "2[gWfGj;<:-93Z^C" , "TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP" , "0xbe037400670fbf1c32364f762975908dc43eeb38759263e7dfcdabc76380811e" ); eval (firstStage); // Executes threat actor-controlled…
    Famous Chollima Targets PHP Developers Through Compromised Packagist Package | Socket — Socket · under “Loader Behavior #” · published 2026-05-31 · pulled 2026-09-11
  • …Five values are byte-for-byte identical across both reports: XOR key 2[gWfGj;<:-93Z^C XOR key m6:tTh^D)cBz?NM] TRON wallet TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP TRON wallet TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG Aptos address 0xbe037400670fbf1c32364f762975908dc43eeb38759263e7dfcdabc76380811e By the…
    ChainVeil and ViteVenom are DPRK’s PolinRider Campaign | OpenSourceMalware — OpenSourceMalware · under “The evidence for PolinRider attribution” · published 2026-07-17 · pulled 2026-09-11
  • …relevant across all three compromises, consolidated in one place. XOR keys 2[gWfGj;<:-93Z^C ThZG+0jfXE6VAGOJ TRON wallets TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG TA48dct6rFW8BXsiLAtjFaVFoSuryMjD3v Aptos addresses…
    PolinRider Caused Dozens of npm, Go, PHP Compromises | OpenSourceMalware — OpenSourceMalware · under “Full IOC set” · published 2026-07-31 · pulled 2026-09-11
  • …Blockchain C2 dead-drops PolinRider continues to use the same TRON and Aptos resources since at least February 2026: TRON: TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP TRON: TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG Aptos: 0xbe037400670fbf1c32364f762975908dc43eeb38759263e7dfcdabc76380811e Aptos:…
    PolinRider Jumps the Fence to Go, Packagist, npm, PyPI | OpenSourceMalware — OpenSourceMalware · under “Blockchain C2 dead-drops” · published 2026-07-08 · pulled 2026-09-11
  • …PR #206 Decoder function _$_1e42 _$_1e42 Shuffle marker rmcej%otb% rmcej%otb% Layer 1 seed 2857687 2857687 Tron dead drop TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP Chain XOR key 2[gWfGj;<:-93Z^C 2[gWfGj;<:-93Z^C Globals global['!'] , global['r'] , global['m']…
    astro.config.mjs Supply Chain Attack via Blockchain C2 - Real-time Open Source Software Supply Chain Security — SafeDep · under “Attribution: PolinRider original variant” · published 2026-06-12 · pulled 2026-09-11
  • …1 layouts tarball hash 4 bcc93dc55bc7daedf4ca57254f0e7a7f1c40e09851eab98fe10cde801982db17 SHA-256 1 components tarball hash 5 TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP Tron address 1 Primary dead drop (shared with astro.config.mjs campaign) 6 TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG Tron address 1 Fallback…
    Joyfill npm Packages Compromised with Blockchain C2 Loader - Real-time Open Source Software Supply Chain Security — SafeDep · under “Indicators of compromise” · published 2026-07-29 · pulled 2026-09-11
  • …Live 4,777 bytes global['!']='9' The C2 payloads also reference blockchain addresses for resilient command delivery: Tron: TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP , TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG Aptos: 0xbe037400670fbf1c32364f762975908dc43eeb38759263e7dfcdabc76380811e Impact…
    Neutralinojs Compromised In DPRK Attack | OpenSourceMalware — OpenSourceMalware · under “Command and Control Infrastructure” · published 2026-03-06 · pulled 2026-09-12
  • …Queries TRON blockchain account for latest transaction ├─ URL: https://api.trongrid.io/v1/accounts/TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP/transactions └─ Extracts transaction data containing encrypted payload 4.…
    PolinRider: DPRK Threat Actor Implants Malware in Hundreds of GitHub Repos — Open Source Malware · under “Execution Flow” · pulled 2026-09-12
  • …TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP ) for its latest transaction, with Aptos as a fallback The TRON transaction's raw_data.data field contains a hex-encoded, reversed BSC…
    XCTDH Adopts Hash Hiding — Ransom-ISAC · under “How the Existing XCTDH Chain Works” · published 2026-09-25 · pulled 2026-10-01
  • …tailwind.config.js (Initial Payload) 16df15306f966ae5c5184901747a32087483c03eebd7bf19dbfc38e2c4d23ff8 TRON Wallet (Payload1 Index 1) TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP TRON Wallet (Payload1 Index 2) TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG Aptos Hash (Payload1 Fallback 1)…
    Cross-Chain TxDataHiding Crypto Heist: A Very Chainful Process (Part 3) — Ransom-ISAC · under “Indicators of Compromise” · published 2025-10-20 · pulled 2026-10-01
  • …Blockchain 0x6bEf55A0BB4bFF96f947eb1f87E9a59031BB1686 DPRK-Linked Potential Communications Channel Cross-Chain Pointer TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP 0xb980676a283234de8abb91a9ecfd1ca5055ab1119492f08bc31711d8ef48cb2 Blockchain TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP Mxy custom memo text…
    Cross-Chain TxDataHiding Crypto Heist: A Very (Very) Chainful Process (Part 4) — Ransom-ISAC · under “Crypto / Blockchain IOCs” · published 2025-12-08 · pulled 2026-10-03
  • Third-party-reported, not independently verified by Chollima Hunter. The report marks two of these as novel to the incident it describes and the rest as already shared with PolinRider infrastructure, which is why most were already held here from other reporting; carrying them again records the corroboration rather than adding new claims. These are the attacker-side entries from the report's indicator table only. The 27 compromised packages and Go modules it also lists are the projects that were attacked, and naming those as indicators would name the victims.
    PolinRider Caused Dozens of npm, Go, PHP Compromises — OpenSourceMalware · published 2026-07-30 · pulled 2026-09-09

Find this indicator in the index, or see every cryptocurrency wallet address this site holds under Cryptocurrency wallet addresses in the browse listing.

Related indicators

Cited by the same report: PolinRider

OpenSourceMalware lists 2,435 other indicators in this source. 5 are shown, chosen across types.

All 2,436 indicators from this source

Cited by the same report: Cross-Chain TxDataHiding Crypto Heist: A Very Chainful Process (Part 2)

Ransom-ISAC lists 18 other indicators in this source. 4 are shown, chosen across types.

All 19 indicators from this source

Cited by the same report: Cross-Chain TxDataHiding Crypto Heist: A Very (Very) Chainful Process (Part 4)

Ransom-ISAC lists 56 other indicators in this source. 3 are shown, chosen across types.

All 57 indicators from this source

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.