The recent breach in cybersecurity began with three seemingly unrelated alerts sounding off simultaneously. On the asset chain side, the Polkadot Community Foundation recently issued a security announcement, specifically naming versions 3.0.1, 3.0.3, 3.0.4, and 3.0.5 of the Fearless browser extension as being infected with malicious code, which was active during various periods from February 2025 to October 10, 2026, silently forwarding private keys when users unlocked their wallets. According to incomplete statistics from a single media source, this incident may involve approximately 17,286 DOT, with at least 8 users reporting unauthorized actions or losses, although the exact scale remains uncertain. At the infrastructure level, the PHP development team disclosed two serious security vulnerabilities this Tuesday and released an emergency patch the following Wednesday; multiple government websites in Europe and other regions opted for preventive downtime during the disclosure and patching window, forcing Dutch and Finnish institutions to temporarily close certain services to avoid becoming testing grounds for publicly disclosed vulnerabilities. On the attack paradigm level, a report from Straiker reveals that the hacker organization CyberCartel is building an AI intelligence network powered by multiple vendors' large models, utilizing model resources including those from Anthropic and SpaceX to launch automated attacks targeting over 400 financial institutions in Latin America, attempting to replace traditional "human hackers" with machines. From personal wallets to government websites to financial systems, trusted tools and technologies are beginning to transform into attack vectors, with cracks appearing simultaneously in asset layers, fundamental software stacks, and means of attack, forcing the boundaries of trust in the entire digital world to stretch. Moving forward, we need to reinterpret what this round of risk escalation actually means, from incidents and commonalities to response paths.

Wallet Extensions Poisoned, Polkadot Private Keys Exposed

At the forefront of this risk chain is a wallet tool, originally viewed as a "secure entry point", that has been directly poisoned. The Polkadot Community Foundation has confirmed that versions 3.0.1, 3.0.3, 3.0.4, and 3.0.5 of the Fearless browser extension contain malicious code, meaning that at the moment users unlock their wallets in the browser, the core private keys could be silently packaged and forwarded to the attackers' servers. More critically, this malicious code is not a "flash in the pan" zero-day script, but rather has been active during multiple periods between February 2025 and October 10, 2026, with an attack window spanning nearly two years; most users have been operating their assets at risk while experiencing virtually no perceptible anomalies.

According to reports from a single media source, this incident may involve approximately 17,286 DOT, with at least 8 users reporting unauthorized operations or losses; these quantified data still require further verification, but are sufficient to outline a clear picture: attackers do not need to break through the Polkadot chain's security defenses. As long as they control user-side tools, they can directly access and steal private keys under the guise of users thinking "self-custody is safer." This is a typical supply chain attack on wallets, which tears apart the long-held myth that "as long as you hold the private key, it is absolutely secure." When the tool that holds the private keys is compromised, the security boundary between self-custody and custody begins to blur.

PHP Vulnerabilities Expose Risks to Government Sites

If the poisoned wallet extension revealed vulnerabilities in user-side toolchains, the PHP vulnerabilities that surfaced this week pushed the consequences of "infrastructure breaches" to the level of public governance. The PHP development team announced two serious security vulnerabilities on Tuesday, clearly urging all users to update as soon as possible; the release of the fix on Wednesday turned what was initially just a routine technical iteration into an emergency response window for governments and enterprises' websites worldwide. As PHP is one of the most widely used server-side programming languages globally, many critical sites' backends were almost simultaneously flagged as "potentially high-risk," magnifying the technical issue into a matter of service availability and social trust.

Before and after the patch release, some European government agencies opted for the most conservative strategy: instead of waiting for attacks to happen, they proactively took down portals or certain online services. Reports mentioned that government sites in countries like the Netherlands and Finland temporarily shut down during the vulnerability disclosure phase, preferring to let the public be unable to conduct online business for a short time rather than risk active exploitation. The structural contradiction behind this scene is very straightforward—when numerous critical systems stake everything on the same foundational software stack, once core code develops a security gap, the issue is no longer "whether a certain website was hacked," but rather the entire digital governance system exposed to the same technological risk simultaneously. In such structural single-point dependency, any security gap in a foundational software stack can quickly evolve into a systemic governance risk at the public service level.

CyberCartel Uses AI to Attack Financial Institutions

While governments and public services are still struggling to manage vulnerabilities in foundational software stacks, another invisible front is opening up within financial systems. An investigation by Straiker reveals that a hacker organization named CyberCartel has built an entire network of AI intelligences powered by numerous vendors' large models, no longer relying on traditional "human hackers", but allowing machines to take over the attack orchestration in the shadows. Ironically, the models used in this intelligent network come from various companies, including Anthropic and SpaceX. Attackers deliberately employ a multi-model collaborative strategy, assigning different models to different tasks, making the entire attack network resemble an assembly line rather than scattered individual hacking skills.

On this assembly line, the targets are no longer the backend interfaces of a specific bank or an employee's email account. Straiker disclosed that CyberCartel, utilizing this intelligent network, has launched automated network attacks against over 400 financial institutions in Latin America (with medium confidence in the data), with intelligences batch-scanning, penetrating, and probing defense strength, then passing effective pathways to subsequent stages for further advancement. Financial institutions are facing not just sporadic singular point intrusions but a replicable, scalable, and continuously operating "industrial system" of attacks: when attack scripts are written as intelligent tasks and models can coordinate automatically, human security teams are no longer dealing with a few hackers but must contend with an automated attack production line that can operate around the clock.

Loss of Trust from Wallets to Government Sites

In the Fearless extension incident, the wallet plugin regarded by crypto users as an "entry-level" tool has itself become a channel for private key leakage: malicious code lurks in multiple versions, directly sending private keys to attackers' servers at the moment users unlock their wallets. Users think they are using a security tool long validated by the community, but in reality, they are handing over their most critical keys to an invisible piece of code. This contrast is not a singular vulnerability but is a direct tearing of the security premise of "trustworthy tools."

Parallel to this is the collapse of the more traditional infrastructure layer. The PHP technology stack, long depended upon by government and enterprise websites, has revealed serious security vulnerabilities. After the release of a repair version, several government websites in Europe and other regions opted to take services offline or temporarily close. Dutch and Finnish agencies have been named for implementing preventive shutdown measures; not because they no longer trust open-source software, but because they suddenly realize that the entire public service facade hangs on a potentially easily breached generic component. At the same time, the AI intelligence network built by CyberCartel has transformed large models seen as productivity tools into automated attack engines, launching batch probes against the information systems of over 400 Latin American financial institutions. These three incidents connect, expanding the attack surface from the technical flaws of a single wallet, framework, or model into a reality where a "trust link" that runs through personal assets, government services, and financial infrastructure is systematically exposed. The security boundary must transition from "fixing a vulnerability" to redefining the composition and responsibilities of the entire trust link.

What Users Can Do Before the Next Round of Attacks

On this "trust link" that has been systematically torn apart, individual users and institutions cannot completely shut off risks, but they can proactively reduce their exposure. The malicious code in the Fearless extension directly steals private keys when users unlock their wallets; according to reports from a single media source, this incident may affect about 17,286 DOT. This incident compels crypto users to reassess the trust boundaries of browser extensions, plugin wallets, and various third-party tools: try to separate tool stacks for different assets and purposes, do not grant all permissions and private keys to the same extension, form the habit of paying attention to official security announcements, timely check versions, and clean up unused plugins, and clearly understand that these practices are merely "damage reduction" under dimensional attacks, not absolute defenses. On the institutional side, security governance can no longer be limited to firewalls, access controls, and compliance documents. Although the PHP vulnerabilities were disclosed and fixed within a day, the "offline-style" emergency measures that forced several government sites down show that the upgrade strategies for foundational software stacks, audit rhythms for local and cloud dependencies, and internal usage rules for large models and intelligences must be written into security protocols, rather than left to operations and business teams to manage haphazardly. The revelation by Straiker that CyberCartel conducts automated attacks using models from multiple vendors also reminds regulators and the industry: even if underlying models pass compliance checks, application layers may still be transformed into attack engines. In the current stage where loss amounts and victim institution lists are incomplete and risk assessments are still in their early phase, the next steps worthy of continued focus include the disclosure and response speeds for vulnerabilities similar to the Fearless incident, whether mainstream wallet ecosystems truly establish executable audit and withdrawal mechanisms, and whether the policies and industry standards around AI offensive and defensive strategies can transition from paper commitments to actionable operating details before the next attack window arrives.

Join our community, let's discuss and become stronger together!
Exclusive Hyperliquid benefits for AiCoin: https://app.hyperliquid.xyz/join/AICOIN88
Exclusive Aster benefits for AiCoin: https://www.asterdex.com/zh-CN/referral/9C50e2
On-chain Telegram community: https://t.me/AiCoinWhaleData
On-chain community: https://www.aicoin.com/link/chat?cid=N6OVMor5g
AiCoin On-chain Twitter: https://x.com/aicoinwhaledata

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到[email protected]，本平台相关工作人员将会进行核查。