The DPRK-attributed XCTDH campaign added HashHiding, also known as NullReceiver, as an always-on Ethereum channel for recovering its current command-and-control address. Malware decodes an IPv4 address and port from fabricated Ethereum transaction destinations sent by a signal wallet that produced 2,655 beacons over roughly 90 days. The channel operates alongside hardcoded infrastructure and the campaign's existing TRON/Aptos-to-BSC chain, supporting DEV#POPPER.js and the OmniStealer credential harvester. Ransom-ISAC observed four encoded destinations and three C2 IP addresses during the collection period.