North Korean Hackers Hide C2 IPs in Fake Ethereum Transfers
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- NullReceiver encodes C2 server IPs directly in the destination address bytes of zero-value, zero-data Ethereum transfers, eliminating the fixed, watchable address that EtherHiding required.
- OpenSourceMalware documented the technique after spotting it in trojanized npm packages "bianira-ui" (109 downloads) and "fluid-type-ui" (587 downloads), both published starting July 28, 2026 and now removed from npm.
- The campaign is linked to North Korean hackers, the same actors behind the Contagious Interview LinkedIn scheme previously detailed by Google Threat Intelligence Group.
- Paul McCarty explained the malware reads the first four bytes of the destination address from the attacker's most recent outbound transaction and converts them from hexadecimal — in one example, wallet "0xa322e5f3d311d3080e6f0121063e9adc2490ef1a" decodes to C2 IP "166.88.134[.]62."
- EtherHiding, first documented by Guardio Labs in October 2023, hid payloads in smart contract calldata; NullReceiver never reuses a destination and carries no fingerprintable field, making each transaction the "cheapest, least conspicuous transaction shape on the network" per OpenSourceMalware.
- The attacker wallet has logged 68 transactions since July 27, 2026 — the day before the packages were first published.
Why it matters: NullReceiver strips away the fixed watchable destination address that made EtherHiding detectable, leaving defenders without a fingerprintable field to track while zero-value Ethereum transfers cost less gas than the prior technique. Two packages totaling under 700 downloads already reached developer machines, showing the npm supply-chain delivery channel is operational.
