Today’s Field Note

Three threads worth your attention, all operational. The third-wave Coldcard exploiter is moving stolen Bitcoin, roughly 10% so far, through THORChain into a fresh Ethereum address, the usual cross-chain wash that frustrates freezes. Separately, Lazarus-tagged addresses pushed about $30M through Hyperliquid, a reminder that perps venues are now laundering rails as much as trading ones. And the Shai-Hulud npm worm has expanded to scan 469 credential locations (up from 189), sweeping CI/CD, cloud config, and AI tool secrets across developer environments. None of this is price noise. It is theft in motion and supply-chain rot, and both hit builders directly.

Today’s Move

  • If you build on npm, audit your dependency tree today for Shai-Hulud compromise, rotate any npm, cloud, and CI/CD tokens, and enforce least-privilege on CI runners. Assume anything in a scanned path is burned.
  • Rotate credentials stored in .env files, AWS/GCP config, and AI tool configs (Claude, etc.); the worm now reads these explicitly.
  • Coldcard holders on affected firmware: move funds to a clean device now, do not wait for tracing to resolve.
  • Watch the flagged Lazarus addresses on Hyperliquid and blacklist them in your compliance tooling if you run a venue or desk.
  • Add the new Coldcard-thief Ethereum address to your watchlists and any inbound-deposit screening.

Resources

  • https://www.reddit.com/r/CryptoCurrency/comments/1w5wffl/lazarus_group_addresses_move_30m_through/
  • https://thehackernews.com/2026/09/shai-huluds-reach-just-grew-to-469.html
  • Incident trackers (reference standard): Rekt leaderboard · SlowMist Hacked

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @ItsAlreadyPrice or subscribe via RSS.