Elastic Security Labs identified a single Ethereum wallet used to deploy and update KREMLIN's malicious contracts, which was associated with 82 USDT transfers totaling approximately 20,778.97 USDT received and 19,016.96 USDT sent between June 19, 2025, and August 24, 2026.