Today’s Field Note

Three things worth your attention. First, over 5,400 hacked small-business sites are now serving ClickFix payloads stored inside smart contracts on BNB Smart Chain, an EtherHiding pattern that turns immutable on-chain bytecode into a resilient malware host you cannot take down with a domain seizure. Second, Trezor disclosed that its shipping provider ShipMonk leaked another 67,000 U.S. customer records (names, emails, phone numbers, shipping addresses, order dates from 2019 to 2021), data Trezor had been told was deleted. Hardware stays secure, but that list is a targeting menu for phishing and physical coercion. Third, Tether-backed Orionx is winding down after an audit found more than $7 million in customer assets had moved to wallets outside its custody, the usual quiet end where “closing” means the money already left.

Today’s Move

  • If you bought a Trezor between Nov 2019 and Aug 2021, treat any “Trezor support” or shipping message as hostile, and never enter your seed anywhere prompted by an inbound contact.
  • Assume your name and home address are on a leaked list, and review your physical opsec accordingly (do not confirm holdings to anyone).
  • If you hold assets on Orionx, initiate withdrawal now and document balances before the shutdown completes, do not wait for orderly wind-down instructions.
  • On BSC, disable “ClickFix” style paste-to-terminal prompts, never run commands a website tells you to copy, and audit any recently installed browser extensions.
  • Patch Chrome today (the V8 zero-day is already exploited) since a compromised browser defeats every wallet approval habit you have.

Resources

  • https://www.bleepingcomputer.com/news/security/over-5-400-hacked-sites-serve-clickfix-payloads-stored-on-the-blockchain/
  • https://thehackernews.com/2026/09/trezor-says-shipmonk-breach-exposed.html
  • https://cointelegraph.com/news/orionx-shut-down-7-million-move-outside-wallets?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound
  • Incident trackers (reference standard): Rekt leaderboard · SlowMist Hacked

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @ItsAlreadyPrice or subscribe via RSS.