Today’s Field Note

The Coldcard hardware wallet exploit remains an open wound. White hats moved roughly 52 BTC (about 40% of what was drained in the second wave) into a Wyoming recovery trust for victims, which tells you the attackers are still actively sweeping funds and this is not resolved. Separately, Checkmarx flagged a malicious npm package, “indexed-btree,” that typosquats the legitimate “sorted-btree” and hides its loader inside runtime code rather than lifecycle scripts, a deliberate move to slip past the scanners everyone bolted on after the last supply-chain waves. Both hit the same soft spot: developers and holders trusting tooling they never audit. If you run a Coldcard or pull npm dependencies without pinning, today is the day to act, not to read.

Today’s Move

  • If you hold a Coldcard, treat any wallet initialized or restored on affected firmware as compromised. Generate a new seed on a verified device and migrate funds now, do not wait for a formal statement.
  • Audit your npm tree for “indexed-btree” (npm ls indexed-btree) and purge it. Confirm you meant to install “sorted-btree” and pin the exact version.
  • Assume any build machine that pulled “indexed-btree” is dirty. Rotate credentials, npm tokens, and any keys stored in that environment.
  • Watch the Coldcard drainer and the white-hat recovery trust addresses (via the Cointelegraph and CoinDesk reports) to confirm your funds are not among the moved coins.
  • Enforce lockfile integrity and disable postinstall scripts by default in CI, since attackers have now moved malicious logic into runtime to dodge lifecycle-script controls.

Resources

  • https://www.coindesk.com/markets/2026/09/22/whitehats-move-52-bitcoin-from-the-coldcard-hack-to-a-recovery-trust
  • https://thehackernews.com/2026/09/malicious-npm-package-indexed-btree-hid.html
  • Incident trackers (reference standard): Rekt leaderboard · SlowMist Hacked

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @ItsAlreadyPrice or subscribe via RSS.