`0x3f0e5781d0855fb460661ac63257376db1941b2bb522499e4757ecb3ebd5dce3`

0x3f0e5781d0855fb460661ac63257376db1941b2bb522499e4757ecb3ebd5dce3 is a cryptocurrency wallet address that 3 published sources report in connection with PolinRider, Contagious Interview and EtherHiding / UNC5342 activity, which public reporting attributes to North Korea (DPRK). It is cited here from OpenSourceMalware and Ransom-ISAC. The earliest of those reports is dated 2025-10-27 and the most recent 2026-07-10.

On-chain links

C2 hosts this address pointed malware at, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. A host whose verdict is decoy was written between real values and is not C2. See the EtherHiding Tracker.

C2 host	Verdict	Network	Provider	Country	First written
`136.0.9.8`	Malicious	data centre	Ace Data Centers II AS149440	United Kingdom	reported
`166.88.4.2`	Malicious	data centre	Ace Data Centers II AS149440	United Kingdom	reported
`23.27.20.143`	Malicious	data centre	Ace Data Centers II AS149440	United Kingdom	reported
`23.27.202.27`	Malicious	data centre	Ace Data Centers II AS149440	United States	reported
`auth-rho-dun.vercel.app`	Malicious				reported
`data-kappa.vercel.app`	Malicious				reported

wallet address PolinRider Contagious InterviewEtherHiding / UNC5342 CURATED

First seen 2025-10-27 · last seen 2026-07-10

Sources

Secondary Aptos dead-drop wallet address used as blockchain-based command-and-control infrastructure in the PolinRider campaign: the malware reads transaction data sent to this address, XOR-decrypts it with a hardcoded key, and executes the result as its next-stage payload. Reported by OpenSourceMalware.
PolinRider — OpenSourceMalware · published 2026-07-10 · pulled 2026-08-30
As printed:

'0x3f0e5781d0855fb460661ac63257376db1941b2bb522499e4757ecb3ebd5dce3',

Notes:

Aptos account the malware queries when the TRON lookup fails: fallback for TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG. The malware reads the account's latest transaction and takes a BSC transaction hash from payload.arguments[0]. Ransom-ISAC prints some of these as "Aptos Hash" in its indicator table; the code it reproduces passes them to the Aptos accounts API, so they are recorded here as accounts. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.
Cross-Chain TxDataHiding Crypto Heist: A Very Chainful Process (Part 2) — Ransom-ISAC · published 2025-10-27 · pulled 2026-10-03
As printed:

Aptos: 0x3f0e5781d0855fb460661ac63257376db1941b2bb522499e4757ecb3ebd5dce3

Notes:

Aptos account the malware queries when the TRON lookup fails: fallback for TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG. The malware reads the account's latest transaction and takes a BSC transaction hash from payload.arguments[0]. Ransom-ISAC prints some of these as "Aptos Hash" in its indicator table; the code it reproduces passes them to the Aptos accounts API, so they are recorded here as accounts. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.
Neutralinojs Compromised In DPRK Attack — OpenSourceMalware · published 2026-03-06 · pulled 2026-10-03

Find this indicator in the index, or see every cryptocurrency wallet address this site holds under Cryptocurrency wallet addresses in the browse listing.

Related indicators

Cited by the same report: PolinRider

OpenSourceMalware lists 2,435 other indicators in this source. 5 are shown, chosen across types.

All 2,436 indicators from this source

Cited by the same report: Cross-Chain TxDataHiding Crypto Heist: A Very Chainful Process (Part 2)

Ransom-ISAC lists 18 other indicators in this source. 4 are shown, chosen across types.

All 19 indicators from this source

Cited by the same report: Neutralinojs Compromised In DPRK Attack

OpenSourceMalware lists 5 other indicators in this source. 3 are shown, chosen across types.

All 6 indicators from this source