`0xa658492ea658492e68656c6c6f6970626f742121`

0xa658492ea658492e68656c6c6f6970626f742121 is a cryptocurrency wallet address that 2 published sources report in connection with EtherHiding / UNC5342, NullReceiver and Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Chollima Hunter (on-chain observation) and OpenSourceMalware. The earliest of those reports is dated 2026-08-02 and the most recent 2026-09-03.

On-chain links

C2 hosts this address pointed malware at, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. A host whose verdict is decoy was written between real values and is not C2. See the EtherHiding Tracker.

C2 host	Transaction	Verdict	Network	Provider	Country	Registered	First written	Last written
`166.88.73.46`	Etherscan	Malicious	proxy or VPN	Ace Data Centers II AS149440	United Kingdom		2026-08-28	2026-09-03

wallet address EtherHiding / UNC5342NullReceiverContagious Interview CURATED

First seen 2026-08-02 · last seen 2026-09-03

Sources

Destination address of the NullReceiver lookup transaction as of 2026-09-03, observed on chain by this site rather than taken from published reporting. It is not a wallet anyone holds keys to but a value chosen so its bytes carry the C2 address: bytes 0-3 and bytes 4-7 both read as 166.88.73.46, and the trailing twelve bytes are the ASCII string "helloipbot!!", the same construction OpenSourceMalware describes for the address it reported. It was paid by the watchlisted resolver wallet 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a at nonce 284 in a zero-value, zero-calldata transfer mined at 2026-09-03T03:10:11Z, which is the transaction the malware would resolve. The transaction was read by scripts/check-etherhiding-contracts.js and re-fetched by hash from a second independent RPC provider, which returned the same sender and recipient.
Ethereum transaction 0x7f9dbf90249bab5c55023850a674f61d2c6844474ce889910fa6c0406884ee37 — Chollima Hunter (on-chain observation) · pulled 2026-09-03
Destination address of the NullReceiver lookup transaction as of 2026-09-03, observed on chain by this site rather than taken from published reporting. It is not a wallet anyone holds keys to but a value chosen so its bytes carry the C2 address: bytes 0-3 and bytes 4-7 both read as 166.88.73.46, and the trailing twelve bytes are the ASCII string "helloipbot!!", the same construction OpenSourceMalware describes for the address it reported. It was paid by the watchlisted resolver wallet 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a at nonce 284 in a zero-value, zero-calldata transfer mined at 2026-09-03T03:10:11Z, which is the transaction the malware would resolve. The transaction was read by scripts/check-etherhiding-contracts.js and re-fetched by hash from a second independent RPC provider, which returned the same sender and recipient.
NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding — OpenSourceMalware · published 2026-08-02 · pulled 2026-09-03

Find this indicator in the index, or see every cryptocurrency wallet address this site holds under Cryptocurrency wallet addresses in the browse listing.

Related indicators

Cited by the same report: Ethereum transaction 0x7f9dbf90249bab5c55023850a674f61d2c6844474ce889910fa6c0406884ee37

Chollima Hunter (on-chain observation) lists 2 other indicators in this source.

Cited by the same report: NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding

OpenSourceMalware lists 15 other indicators in this source. 10 are shown, chosen across types.

All 16 indicators from this source