Everything Got Hacked on Wednesday: Wallet Keys, AI Library, Node.js

Wednesday 21 October 2026 was a heavy day in security. A DeFi protocol on Base trusted a number, a Polkadot wallet extension leaked private keys, the LiteLLM AI library was backdoored on PyPI, and Node.js shipped a security release. Here's what happened, why, and what to do. Slice (Base): FundsModule paid out what fake contracts said they released. ~$41K lost (SlowMist; Defimon says ~$42K). Bounty offer: return 90% (15.11 ETH) by Fri 23 Oct, 17:00 UTC (10:30 PM IST). Fearless wallet extension v3.0.1 / 3.0.3 / 3.0.4 / 3.0.5 sent private keys to a server on unlock. 8 users reported, 17,286 DOT so far. Make a new key in a different wallet; staked DOT → PAPI Rescue. Drift exploiter: PeckShield saw ~18.8K ETH (≈ $46M) go into Tornado Cash again from 20 Oct. LiteLLM 1.107.0 (PyPI, live 11:39–13:23 UTC) + Docker tags were malicious. Last safe: 1.106.2. Rebuild and rotate every key it could reach. Node.js 22 / 24 / 26: 4 high-severity bugs (Brotli out-of-bounds write, TLS hostname bypasses, dns.resolve NUL truncation) + randomUUID snapshot entropy bug. Update Node. Next.js / React (14 Oct, critical): Next.js 16.4.1 / 15.5.28, react-server-dom 19.0.9 / 19.1.10 / 19.2.9 / 19.3.1, sharp ≥ 0.35.5. Chapters 0:00 Wednesday 21 Oct: a heavy security day 0:54 Slice on Base: the contract that trusted a number 1:34 The FundsModule bug 2:17 Two fake contracts + the bounty 3:37 Fearless wallet leaked private keys 5:00 What to do if you used Fearless 5:52 Drift exploiter funds move again 6:36 LiteLLM backdoored on PyPI 7:24 How the LiteLLM attack happened 7:57 The payload + what to do 9:04 Node.js security release 10:06 randomUUID snapshot bug 10:50 React & Next.js: the 14 Oct patch 12:09 Wrap-up Sources Slice: https://x.com/TenArmorAlert/status/21... https://x.com/SlowMist_Team/status/21... https://x.com/SlowMist_Team/status/21... https://x.com/DefimonAlerts/status/21... https://x.com/DefimonAlerts/status/21... https://www.cryptotimes.io/2026/10/21... Fearless wallet: https://forum.polkadot.network/t/secu... https://cryptobriefing.com/polkadot-f... Drift: https://x.com/PeckShieldAlert/status/... LiteLLM: https://docs.litellm.ai/blog/security... https://www.wiz.io/blog/litellm-compr... https://www.theregister.com/security/... https://thehackernews.com/2026/10/lit... Node.js: https://nodejs.org/en/blog/vulnerabil... Next.js / React / npm: https://nextjs.org/blog/nextjs-securi... https://github.com/vercel/next.js/sec... https://github.com/vercel/next.js/sec... https://github.com/react/react/securi... https://safeguard.sh/resources/blog/t... https://vigihq.com/attacks/subquery-n... Numbers are what the sources reported as of recording; loss totals may change. #security #crypto #ai